All committers have signed the CLA.

In my (totally personal and humble) opinion, this kind of change is not desirable in general.

When you want to deploy to test a new app it's pretty cool if the provided docker-compose works out-of-the-box, because you're looking for a fast try-and-test configuration.

Yes the provided docker-compose is not configurable, and yes it is really not secured and shouldn't be used as-is in production. But replacing default value by some environment variable stored in a .env is a Docker feature and workflow, and thus not really the scope of Docmost documentation (once again in my opinion).
Maybe the docs should instead precise that this is not a production-ready compose file and point to the appropriate documentation.