The protected status of the CI vars generated when
creating a service account is linked to the environment
protected status.

When env is not selected, or for CE instances, the vars
are not protected.