This is bizarre to read. gRPC is used _widely_ outside Google. I'm not aware of any API that requires you to use gRPC. I've never found their permission model to be complicated at all, at least compared to AWS.