So you're saying they have lots of personal data (nobody is disputing this). If they have the data, and they let someone else have access to it, it could leak. Which, sure, makes sense.

But that's not the same as "know[ing] Google does the same thing" unless you define either "know" or "the same thing" very loosely.