When I build a project (Ivy-project), that contains multiple ivy-modules, with the following settings:

Ivy xml files: */ivy.xml
...
Ant Builder

Properties: deploytarget.user.pwd=${artifactory_jenkins_pwd} # injected by mask-passwords (global password)
...
x Incremental build - only build changed modules
x Build modules as separate jobs
...
BuildEnvironment
x Mask passwords (and enable global passwords)

the passwords are not injected masked in the buildlog into the module builds. They are shown in plain text in the line of the Ant-call

When I have multiple Jobs, that build the modules directly, the passwords are masked as expected.