I'd more more worried about either hacked sites, or a country with something like China's Great Cannon doing that than a legitimate US company like Google.

Google doing that would be a great way for everyone involved to spend a long time in jail.

> Imagine an actor like google running an intentionally-compromised TLS certificate on their web servers... perhaps even targeted at specific IP addresses or on certain schedules to avoid detection.

For what it's worth, you should read about Certificate Transparency, it tries to protect against this sort of problem. Browsers only accept certs that can prove they've been submitted to a public log, which means that their existence isn't being selectively exposed to some users only.

(They mainly act as prevention against rogue certificate authorities rather than a rogue cert owner, though.)