Then how would you SET the API key in the first place? :) The argument doesn't make any sense at all.

In some .profile or .envrc or what you'd call such a file, I suppose.

And you expect someone will be able to read your bash_history, but not your .profile?

Fair, I wasn't thinking about the details of how someone would lift out the bash history.

Using read or an equivalent, presumably. Just because you don't know why a practice is recommended against doesn't mean that there isn't a good alternative.