It sounds like only a hosted service was compromised, not the open source OpenCode binary that users run on their own machines. So this wouldn't explain that.
run a gateway like LiteLLM or GoModel, don't upload keys to a vendor
- https://gomodel.enterpilot.io/ (my preference)