The likeliest point of introduction is where Google added account login to the browser itself. At that point, either ambiguity of specification or failure to test as though the user thinks Google is a privacy-hostile agency (while using a browser that allows them to login to Google) could have resulted in someone adding a special case to refrain from throwing the credentials away that keep the browser logged in that inadvertantly failed to throw the credentials away that keep a session logged in.