Also, what if google has a rogue employee who works for one of the surveillance agencies?
  
  Trusting all your private data to an advertising company that has root access on your
  device in an app that is explicitly built around security and privacy is insane.

In that eventuallity they might be able to keylog or otherwise monitor the activity of applications anyway. I don't see how you can avoid that sort of eventuality aside from tossing the mobile phone and using snail mail and a OTP. Even then there could be someone looking over your shoulder.