I'd like to note that IO does not give a guarantee of impossibility of extracting keys.

AFAIK, the definition of IO is: we have two programs that perform the same computation. After we apply IO to both programs, we cannot figure out which obfuscated program corresponds to a particular original program.

However, there is a flaw: programs encrypting data with different keys are performing different computations.

So IO definition does not claim that IO is able to hide the key.