The word "only" isn't appearing in the article right now. API keys are used as an example of what's contained in the code.

I wouldn't worry about MySQL passwords though: Automattic controls their database servers, so they can generate new credentials very easily.