Service account keys makes your google account vulnerable, they need to be managed.
https://cloud.google.com/iam/docs/best-practices-for-managing-service-account-keys
You need to have a procedure in place to manage their lifecycle with key rotation.