Seems that indeed there is no way to hide IV and Key in command line

And someone in OpenSSL mailing list explains that openssl binary is not for production use (only dev/demo tool)