The key is linked to the signing key of the app. So even if they have the key they still need the signing key to use it.
In the general case (not necessarily for Android), having a Google Maps API key is enough to gain access for anyone's online use of GM. The keys can be gotten easily enough, but each has a traffic cap and a few other constraints. Publishing a key undermines the system.