Why Gemini API doesn't check IAM roles?

Just got hit with a ~$2k surprise Gemini bill from a leaked service-account key. The part I can't wrap my head around:

The abused SA only had Logs Writer. It's used solely to write app logs to Cloud Logging. Yet it was able to cal generativelanguage.googleapis.com and rack up image-generation costs — and Google knew exactly which SA it was and what (limited) roles it had.

Vertex AI (aiplatform.googleapis.com) enforces IAM — the same SA would've been denied. But the AI-Studio-style Gemini API seems to only check "valid credential + API enabled + billable project," with no per-call IAM permission at all.

So my questions:

1. Is that actually the intended design — no IAM enforcement on generativelanguage?

2. If so, why? A least-privilege SA gives zero protection against Gemini spend, which feels backwards.

3. Best practice to prevent this beyond disabling the API and not shipping keys? (Org Policy, quotas, etc.)

Curious if I'm missing something or if this is a known gap. Thanks.