For the record : those two parts (their CA / own services, and their teams responsible for security) are really well separated and it is not the first time a Google thingy is deemed unsafe by Google security.

Whatever one thinks of Google, it's hard to not agree that they take security very seriously, both internal and external (and project zero is one of the best thing ever).

Personally, I prefer it that way. Better to see "ahah, Google tells me Google is insecure" than allowing something flagged as bad just because it come from the same mothership.