I think the argument is something like, why support a method that is insecure nearly all the time and leads less-experienced users to make the wrong choices.

Good security software gently herds the non-expert to make good choices. Too many options, especially specialty risky options, don't help that goal.

true most ppl will do it command line..

This is why ansible-vault (which is not trying to do the same thing) spawned a temporary editor, and immediately upon save encrypted the file - it doesn't exist in history, nor is there a chance of leaving it behind on disk.

There's probably a way to do what you have launching an editor with stdin, but I'd probably suggest documenting an example, to avoid the risk of leaving the secret around.

Also +1 to removing the insecure history option. Documenting the stdin to use 'cat' or something that's not in the history would probably take care of that one.

Why not use interactive CLI instead of command line CLI (like routers have) to avoid leaks through the shell command history and other related channels?

I think what you mean by "interactive CLI" is reading from stdin, which seams to be supported.