what causes the bacteria growth (is it caused by the water/moisture level) ?
Each of these foods on their own are preserved by having too little moisture for bacteria or molds to live in. So in your specific case, it was likely the water which made it hospitable for them again, yes.
If you have a food which supports bacterial growth, you cannot make it safe by simple sterilization. The sterilization is not always sufficient, and you need laboratory tests of your recipe to confirm that it can work with sterilization (usually only OK for some combination of sufficient acidity and sufficient processing temperature, like water bath canning). And it is no longer shelf-stable after opening. So I wouldn't suggest going down that road. Sterilization of the jar doesn't matter.
You can try making any gianduja recipe that doesn't call for water-containing ingredients (butter or cream or water). There is no need to pick one with cocoa powder or milk powder. Or if you are very intent on using the powder, melt the sugar as for caramel (waterless method) but stop as early as possible, before you have gotten much caramel flavor. Add the powders to the caramel and mix thoroughly. Adding the shortening at the same time can make it easier.
The problem with this approach is that you can have difficulty making it spreadable, since the water thins it. But maybe it will work with enough shortening added.
As for botulism, I have not heard of gianduja being a botulism risk, but homemade variants usually require refrigeration, so you may want to research that separately.