The problem people have is that when they generate an API key they grant that key "everything" even account management stuff. Instead of giving it the least privilege needed to accomplish whatever it is that it does.
Then they'll inadvertently upload it to e.g. GitHub or similar in some source code and bad guys have bots which will steal it then make use of your account for all kinds of evil purposes.
Having things like 2F on your main account (which you should) won't save you from this. And if you go to bed, by the time you wake up the account charges could be in the tens of thousands even with billing alerts.
