Currently, the Icinga DB Web module renders the custom variable _override_servicevars as shown below, which was introduced by Icinga Director module to conveniently override the custom properties of services in a host. And hence it should not be displayed in the UI. Moreover, as shown in the screenshot it exposes the values of custom properties whose visibility is actually hidden.
This is currently solved by adding the property _override_servicevarsto denylist in Icinga DB Web module.
But this should be instead handled in the CustomVarRendererHook implementation by adding a feature to blacklist custom variables.