I am not sure if you know this but when a "website" asks you for your api key (youtube api key in this case), they encrypt and store it somewhere else like a vault storage by 3rd party regulated storage services (Like one which Amazon provides), so I don't see how a "website" can misuse the access via keys :)
Thanks for sharing your thoughts though