Hey there! I wouldn't say this is a security issue - every server on the internet has a public IP address that shows up in all communication, so that's going to happen regardless of the type of connection being made.
If the server is properly configured with a hostname before the initial installation is performed, you will not receive the automated hostname. We mention this in our docs here:
"Newly-installed servers without a fully-qualified domain name (FQDN) as a hostname will automatically receive one from cPanel, L.L.C. The hostname will be a subdomain of cprapid.com."
Newly-installed servers without a resolvable fully-qualified domain name as a hostname will automatically receive one from cPanel, L.L.C.
docs.cpanel.net