SFDX: where can set Field-level security and accessibility?

It's in profiles/[ProfileName].profile-meta.xml, just as it would be in the Metadata API. You need to make sure you push/pull profiles in order to get field security. You can also do so by way of the source retrieve command, such as:

sfdx force:source:retrieve -m Profile:Admin,CustomField:Account.MyCustomField__c

The issue is because you are not pushing the profiles along with the other metadata. The FLS is present in the profiles . I usually recommend to move away from profiles and go with permission sets as those are more flexible .