Is it secure to store API keys on the customer with unauthenticated_read_customers?

Hi there,

We have an API that we want to integrate with our shopify customers. As far as I can see it is secure to store the metafields, because to access the metafields you need to provide a shopify customer access token.

Can you confirm if there are any security vulnerabilities.

 thanks .