When developing a single page application utilizing technologies like Firebase, do API keys remain hidden from users since all code is executed on the client side? Additionally, given that users are limited to specific routes or pages based on conditions defined in the code, does this prevent them from tampering with or altering the code due to its client-side nature?