I don't care about the log retention period. My assumption is that Google does a better job of real-time log monitoring than most other tech firms, and that they are between a rock and a hard place with respect to retention owing to privacy concerns. Either way: it's simply not a real-world norm to conduct a forensics investigation after the internal discovery a vulnerability, so any work they did in that regard easily clears the industry bar.