Private data should not be allowed to be accessed using public keys. That is the core problem. It is not about Google API keys are secret or not.

It was intended for situations where the keyholder is a middleman between Google's API and the end user.