I think they meant to not ship secrets inside the container using the Dockerfile keyword ENV, because they're retrievable. If you must ship a ENV value in an image to the public (it's quite useful for config values that need a default), then know that it isn't secret anymore.

If you need to provide a secret value to an image and it needs to remain secret (like a database password), you most commonly would set the env values at runtime or volume mount a config file at runtime.

On a different side of this, if you need a secret at image build time (like an SSH key to access a private repo), you can use build arguments with the ARG keyword and they won't persist into the final image. Multi stage dockerfiles are also a great way to keep your final image lean and clean.