I have an IoT device that pings the YouTube API every few days using my personal Google account API key, should I be concerned?
A less snarky answer is "is the IoT device made by Google or has a Google license?" If yes, then "probably no," otherwise "yes."
I have a theory as to why Google is so tight lipped about how their service works (and what actions will get you kicked off)---it's that Google employees have no idea. Google is so invested in AI and machine learning, that I suspect that their automated systems are as inscrutable to them as they are to us, but admitting such wouldn't look that great.