Google API Referrer restriction

I see this API referrer issue has come up in the past, but no recent news that I could find.
The docs at https://docs.simplecalendar.io/google-api-key/ casually ignore the referrer restriction part of creating an API key.
Currently from tests on my site (https://www.opendhamma.org.nz/calendar/) if I restrict the API key, no data come through and the calendar disappears from the page. However as soon as I open the API key then the calendar displays with the events.
Now surely after all this time I can’t believe that this plugin would need such a security breach to work.
Can anyone please tell me what the situation is?