Comment by RossPenman

Yes. That's true - if your source code is exposed to a client. Going back to my example of Twilio apps, usually the code that interacts with Twilio is on the server side, so you couldn't find the API keys by viewing source.