I was just mentioning it because even Google says in the docs that you should not use it.

But anyway, you are right. There is no perfect option to secure credentials or API keys in mobile applications. All your approaches are viable and it depends on the developer to decide what's the best solution for their case.