The api key (swarmcdnkey) is specifically designed to be used on all of your public facing pages. It cannot be used to access your account.
The only reason someone might want to use it would be to enable SmartVideo on their website without paying for their own account. In those cases our support team can take actions to limit the use of the key to just domains you specify.
Any unauthorized usage will never count against your video view and domain limits.
Restricting the domains for API key usage is not enabled by default as it significantly impedes your ability to test and develop on staging, testing, local, and developer machines as they likely all have differing domains. We have also seen it is significantly unlikely for somebody to use your API key as the risk of having their website stop working when discovered is usually costlier than them just purchasing their own license.