If it's publically accessible and not password or rate-limited then it's fair game for hackers to goof around with. Just don't base your startup on a (any) Google API.