I'm not sure if you have used Google Apps before, but from memory it has DNS and website verification, so I can only assume it'd be vulnerable to this sort of attack.

Let's face it, being able to serve content on a website at all is enough to prove you own it these days.

You are misunderstanding how DNS works. Just because I can get a google cloud name server to point example.com at my server does not mean I own the domain. The gcloud nameservers are not the authoritative nameservers for the zone unless the root .com registry points at them.

Google apps verification only asks the nameservers designated by the registrar for the domain.