Paradoxically, trust-ruining incidents is what makes Google trustworthy. There's a strong postmortem culture. "We messed up, what systems and processes are now needed to never mess up like this again?" I hear that's also reinforced by how legal achieves settlements. And usually it's one team messing up, but all of Google being in scope of the remediation.

This has the downside that the number of organisations that need to approve any launch ends up being borderline overwhelming. This is a big part of why it takes so long, if at all, to get Google products outside the US. Another implication is needing the expensive security org and culture.