Yes, however it still means that the browser is phoning home to somewhere. To be able to make use of that API key, it has to send some data out. Is that data routed over TOR? Does it even matter given that an API key can be used to deanonymize you?
My understanding (and this may have changed), is that you have to initiate the AI features each time (e.g. clicking on "Summarize This").
But yes, your point is valid. For Tor, if you enter an API key, you could be identified. Still, does the Tor Browser prevent you from installing addons which are no more secure than these AI features? It didn't years ago - not sure if that's changed.