I often wonder how much modern IT infrastructure is simply this mess of 'we have no idea how it really works' blackboxes strung together with API calls.
I suspect you're right about how much of a true understanding they (at google) still have of the behaviour of their search engine.
It would be a winning battle, since it is less work to blacklist than to make a high scoring site.
I guess Google Search internally is a mess. Maybe they have no clue what they are doing or have some really bad directors and lower managers messing stuff up.
Maybe there are so much blackbox ML called from 1000s of Perl files that the engineers don't understand what is happening.