The (config/cli-args) provider checks for the --help flag, and if it finds it prints the help message and exits. If the cli-args provider is used twice, once for settings and once for secrets, then only one of them will get a chance to process the --help flag, and thus only settings flags are printed, even though the secrets flags will still work.
We probably want to rethink a bit how this work, the current behavior of side-effecting and exiting in the middle of what is really just a key lookup is not ideal.