I understand the confusion here.
There is no confusion. The OP is lying and misrepresenting the risks. He claimed that the API key "can act" as a Bitcoin private key so many times that there is zero room for any confusion.
I could even build a platform that simply creates a bridge between a previously linked bitcoin private key and the api key of your account on the platform.. the result would be an api key that can do every single thing you could directly do with the private key. why? because an api key is just a tool of authentication . what it can do it depends on the platform that generated it.
You were specifically talking about BitMEX API keys, which do not act as bitcoin private keys no matter how far you want to stretch the definition. You are now changing the context of what you were previously talking about in order to avoid having to admit you were wrong.
You can build a platform to use bitcoin private keys in any manner you'd like but its not the same thing as BitMEX API keys.