With Client IDs, there was one identifier per app and no way to restrict how it was used. If it ever got exposed, you were in trouble.
API keys solve that in a few ways. You can set specific restrictions on each key, limiting access to certain domains, IP addresses, or usage patterns, which significantly reduces the risk of unauthorized access. You can also create multiple keys per app, so if one gets compromised, you just revoke it and generate a new one without affecting anything else. And since you can monitor usage per key, spotting unusual activity is a lot easier.