In Firebase world API keys are for identification, not authorisation.

https://firebase.google.com/docs/projects/api-keys

Public by design: API keys for Firebase services only identify your Firebase project and app to those services. Authorization is handled through Google Cloud IAM permissions, Firebase Security Rules, and Firebase App Check.