I wouldn't really consider these "keys" or "secrets", they're more like a user identifier. Having them probably means you can now write another app to access the same data... and if that was in any way considered a security issue, it wouldn't be solved by not having those identifiers in the app either.

(Of course there might be some APIs that allow doing more by interacting with them directly than what the app originally allowed, but I think those are just cases of bad design.)

Some Websites require you to pay money for access to their API.

Some of them also have a HTML5-App (with a wrapper) available for Android. This app uses the same API.

So some malicious developer could just unzip the app, read the JavaScript and find the API-key, and use their key instead of paying for one.

And as the website usually has many accesses from the same IP (due to mobile users being behind NATs), the Website will never find out that someone is abusing their API.

And some websites do not have public APIs at all. I've already used this technique to "discover" the private API and the access keys, nothing sensitive and only for personal use of course.