Google also changed the rules on API key security after years of precedent.
https://trufflesecurity.com/blog/google-api-keys-werent-secrets-but-then-gemini-changed-the-rules
I'm sure they have a reason for everything they do, but rarely are they good reasons.