Google's own recommended practices https://developers.google.com/maps/api-security-best-practic...

It would be helpful if you answer the question about web api usage, most of that is not relevant.

The only suggestion I see there from a quick skim that would avoid the above is for customers to set up a google maps proxy server for every usage with adds security and hides the key. That is completely impractical suggestion for the majority of users of embedded google maps.