this is not true.

BuildConfig is a java file like all others, so it's also packaged within the apk.

Reverse the apk and you will see your API_KEY there.

using gradle.properties to store secret keys and hardcoding them in code are somehow the same thing in term of security.