Unnecessary cost? It's the cost of preventing hackers from being able to spin up 100s of EC2 instances using your account.

Make your own damn API. Have it do exactly what users are allowed to do on your behalf. It's not an unnecessary cost, it is 100% necessary if you are interfacing with external services from your app.

Or don't, and get bitten in the ass eventually.

That EC2 example is a bit extreme, but in general I agree with what you are saying. Unfortunately, the reality is that most people paying for software development are more willing to accept these risks than to pay for security.

That said, security is not all-or-nothing. And anyone who believes that modern web-connected software can be 100% secure is either misinformed or trying to sell you something that you probably don't need.

If instead of exposing your API keys you implement an API that proxies that responsibilities your app would have needed those keys for, how are your API keys not 100% secure? You even get the added benefit of separating the implementation of those responsibilities from your app (and with app update processes being what they are, that's a huge deal when you need to make an emergency change to how you're using those APIs)

Amazon Congito already provides it for both registered and unregistered users:

https://aws.amazon.com/blogs/mobile/using-the-amazon-cognito...

And they also provide a generic TVM (Token Vending Machine) implementation that you could adapt for other APIs