You're right. That's been my argument against trusting "the cloud" (i.e. somebody else who actually own the computers on which you place all your precious trade secrets and personal business) for the past 15 years...ESPECIALLY when there is no clear agreement or customer/vendor relationship, and they're doing it for "free".

Note that client side encryption changes this https://support.google.com/a/answer/10741897?hl=en.

Is that a surprise to anyone? It's literally a service where you upload your data directly to their servers. Businesses have contracts with other businesses to protect them against particular kinds of abuse of this data (e.g. google stealing business secrets, or leaking personal data as defined by GDPR) and google sticks to these because businesses would lost trust very quickly if they didn't respect the contracts they have.

It is a giant surprise to many managing directors and other people who are not that technical.