"The assumption he implicitly makes is that Google is not going to do anything malicious with his password … "

Not necessarily "malicious" - I wonder if I could set up some adwords targeting keywords out of the popular passwords from the various lists of exposed passwords (Gawker, Sony, RockYou, etc), and attempt to social engineer people to give me "just" their passwords on my landing pages... I wonder if I had an unusual password, perhaps "incandescent-frog", in my email archive - could an advertiser "detect" that from me clicking an ad?