Here's the fix: fork the redis API for your language (nodejs,java,c#, whatever it may be) and remove the .KEYS function completely. Stop your entire dev team from shooting themselves in the foot.
Isn't this why rename-command exists? Just "remove" it on the server side by changing KEYS to a blank string.
It doesn't stop them using it in a Lua script. Better off renaming the function in the config file to a some UUID.
Christ, any sympathy I had for them vanished when I saw they were using keys... The documentation is very clear about query complexity so this should have been an obvious one.