Maybe it's because they tend to be too long to memorise over someone's shoulder although password fields are also protected from control+C. Also people who have access to alter the API key are likely
1. trusted parties
2. able to get the key through inspecting requests in their browser, etc (in general, not necessarily in Zendesk apps).
This is OK as is though - no harm in a bit of extra protection