That still doesn't really protect the underlying API from abuse because the intermediate server could be abused by someone who stole that intermediate server's

That still doesn't really protect the underlying API from abuse because the intermediate server could be abused by someone who stole that intermediate server's API Key from the app. The benefit is that folks wouldn't have full access to the underlying API, but it may be enough depending on the evil doers purposes.