We're talking about giving out a forgotten password, not getting access to email contents.

I used to work on the indexing system, not GMail, but my vague recollection is there are some master private keys (necessary for lawful intercept, etc.) locked in hardware modules for email storage, where very few binaries are able to get the hardware modules to perform public key decryptions. There are strong safeguards on humans using some of the binaries that do have access. Access to these encryption keys is orthogonal to access to the account password. My recollection of the Aurora attacks is that the intruders got access to some systems that were able to decrypt/display senders and subjects, but we believed they were unable to get at the email bodies.

They can do a password reset, however would need sufficient proof of account ownership. Having access to the account is unfortunately not enough proof to show ownership, as that could be achieved with access to someone else’s device.