Not necessarily. He can first transfer whatever amount is still in the address controlled by that key to another address and then publish the private key of the address that now has a balance of zero. What's the problem with that?