I've come across this issue as well, and solved it the same way, by creating a column security profile allowing read permission on this one column, and assigning the affected user to that profile.
It's a strange thing. I found two column security profiles, both named "ReCaptcha Configuration - secret key management", both created by “SYSTEM”. One was created in 2024, one in 2025, but both were updated last week (21/07/2026). The 2025 profile allows read-permission on the recaptcha field.
I do wonder why reading that ReCaptcha API key is required to save other form settings, and I wonder if this undocumented security profile is the correct solution.