Headers usually use - as opposed to _, and some auth proxies may only support -. As setting environment variables with dashes is more complex than underscores, maybe it makes sense to replace them. This would technically be a breaking change if an auth proxy only supported underscores.

An example of a case where the proxy does not support underscores but does support dashes is Cloudflare Access (with service tokens, more info).