Using secret variable in Visual Studio Build task with classic Azure DevOps Server pipeline

We have a classic build pipeline with a (secret) environment variable defined like this:

We have a build steps which uses the "Visual Studio Build" task to build a solution, which contains assemblies which check the contents of the Foo_License variable for a valid license:

However, when using a secret variable the build fails because (apparently) the secret value isn't available to the build step. If I change the variable to a non-secret variable it works (as do other options, such as placing a license file on the build server, or setting the variable there).

It would be ideal if I could use the secret variable used in AzDOS though, to minimize public exposure of the license. The docs say:

Unlike a normal variable, secret aren't automatically decrypted into environment variables for scripts. You need to explicitly map secret variables.

which is fine, but how can I achieve this in a non-script build task?

I think you should try what's already explained here:
How to add secret variable as task environment variable in VSTS

Set Environment Variable

Use the command line or powershell task and do something like

Write-Host "##vso[task.setvariable variable=LicenseKey;]$(Foo_License)"

Pass the variable to your build step

Pass the variable as MsBuild argument:

/p:Foo_License=$(LicenseKey)