There are no seruce Bundle variables atm. So if some secure information is passed to package:
<Variable Name="my_password" Value="secureInformation" Type="string"/>
<MsiPackage Id="my" SourceFile="my.msi" Cache="no" Vital="yes">
<MsiProperty Name="MY_PASSWORD" Value="<span>[my_password]</span>"/>
</MsiPackage>
It will be written into Bundle log file unprotected:
1) --- Initializing string variable ‘my_password ' to value ' secureInformation' ---
2) Applying package: my, ..., arguments: 'MY_PASSWORD="secureInformation"'
I see Hidden attribute was added to Variable declaration in Build 3.6.1908. It indeed hides variable in logging during intialization or changing in BA.
BUT 2) from my description is still actual. It does not hide variable value when it is passed to applying package as command line agrument