The answer to your question is more of a performance consideration, than a security one. Because scoped API keys do enforce security strictly. But if for eg, your single collection grows to 10s of millions of records, it might be better to start sharding it into multiple collections at that point.