Does this mean he could accidentally get a $1 million credit card bill from google from someone using his key without his permission? (I don’t know how it works with google.)

Oops... Thank you. I've disabled it.