With respect to Google shoulders that risk all by themselves, this is clearly not the case. If an attacker discovers this issue and discloses it, by your logic, the fault would be all theirs.

The fault is with the creator of the software, not the discoverer of the flaw.

This broken logic has been around since at least when "Stalking the Wily Hacker" was released. Those who make the error and release broken software and systems should be held accountable, instead of throwing teenagers in jail.

Don't release software, especially important software, unless it is finished.