I'm absolutely not defending Google here, to be clear: Retroactively expanding the scope of an API "key" explicitly designated as "public/non-sensitive" is very bad.

But the concept itself does make some sense, and I'm just noting that there's precedent both across Google and other companies.