I can answer part of the "why". (Probably not the OP's reason, though.)

A number of standard tools also take options from environment variables. E.g. less, gzip. This is a dubious practice, for sure. Less instructs the user to terminate any string args with a dollar sign '$' in that case. Gzip's handling of environment is still broken AFAIK was broken¹⁾. (It'll gladly read filenames, not just arguments—to a very comical effect when "GZIP=/bin/gzip" happens to be the case.)

The problem may also arise from attempting to bypass shell invocation for whatever reason.

1) Correction: this seems to be fixed in gzip version 1.7.