Firebase restrict browser api key to localhost and what if a hacker does the same

Question

I learn Firebase and see under the Firebase console apis i can and I must of course restrict the key to my website domain only.

But what or how do I handle when I hav