It isn't for you, me, or Google to determine whether or not there are potential negative outcomes coming from the unexpected use of very sensitive data such as CC #s, or what amount of risk is acceptable. That sort of assessment can only realistically be done by whoever's data it is.

That Google appears to be so cavalier about this is a serious, but unsurprising, thing. I don't think I'd call it "evil", though, so much as "abusive".