Ignoring for a moment that most of those 500K users had probably forgotten they even had accounts, what strikes me as particularly shameful is that Google decided against informing anyone back in March when they discovered the bug.

If they couldn't tell exactly who was affected, or whether any data had in fact been improperly accessed, shouldn't they at least have notified users of the possibility their private data might have been leaked?

Oh, but that might have drawn "regulatory interest".... much better to sweep it under the carpet and hope nobody notices.