On the other hand, if it does present the servers and it's still configurable, might be a bit of a different story.
It's sort of a sane/understandable default, considering all the context.
Though maybe they could switch to CloudFlare.
Google keeps Permanent Logs and doesn't make it easy for me to see whether that information can be shared and to whom.
Cloudflare only stores Public Resolver Logs, deletes them after 25 hours, and acknowledges it shares an anonymized subset of the data only with APNIC Labs.
Your comments about build pipeline and firmware are interesting, and to me fall into two rough camps:
* preventing bugs from leaking private info: to be honest, I trust neither on this, and I'm more worried about Google being sneaky in its ToS than Cloudflare being sloppy in their dev process.
* preventing infiltration from state actors and hackers -- this is a non-goal for me.
So for my goal of limiting the power of surveillance capitalism on my life, Cloudflare appears to be a clear winner.
Why even bother covering this case? It seems most likely to come up when this situation is created intentionally, in which case you don't want to go and ruin it by trying to be clever.