Google isn't short of competent employees, and they obviously acknowledge the importance of hsts having played a big part in creating it, yet they don't have it turned on. Evidently, getting a single header turned on in a large organisation must be a complicated matter!
Look at [1] - in particular, look at the list of Google affiliated domains that don't include "include_subdomains": true, "mode": "force-https"
blogger.com, youtube.com, gmail.com, google.co.uk, doubleclick.net
Google isn't short of competent employees, and they obviously acknowledge the importance of hsts having played a big part in creating it, yet they don't have it turned on. Evidently, getting a single header turned on in a large organisation must be a complicated matter!
[1] https://chromium.googlesource.com/chromium/src/net/+/master/...