Considering that the Mandrill API Key is both sensitive and system-specific, I think it is safe to define it as sensitive following the Magento 2 configuration guidelines.
I haven't tested it on previous version of Magento 2 but I guess the DI configuration will simply be ignored on those versions.
Magento 2.2 introduced the notion of sensitive/system-specific configuration.
Considering that the Mandrill API Key is both sensitive and system-specific, I think it is safe to define it as sensitive following the Magento 2 configuration guidelines.
I haven't tested it on previous version of Magento 2 but I guess the DI configuration will simply be ignored on those versions.