So, here’s the answer:
Unbeknownst to many PhoneGap/Cordova developers, the HTML/JavaScript/CSS assets that make up your mobile app are not compiled or otherwise obfuscated when the final app package is built. Unlike the true native bits of the app (i.e. the Cordova framework and custom plugins), which do get compiled into byte code, the core HTML5 assets exist, as they are delivered, inside the app package.
Source: Telerik & Kendo UI - .NET Components Suites & JavaScript UI Libraries
I’m going to figure out if I can use something like Telerik’s Cloud Functions to return the API keys.
Here’s a related thread on obfuscating secret keys for services like Firebase: App security: Store Api secret key for using remote REST service
Thanks again for the heads up.