Does Google warn you about this when you sign up? No.
And PayPal having the same problem in no way identifies Google. It just means that PayPal has the same problem and they are also incompetent (and they also demonstrate their incompetence in many other ways).
Sorry
No, thank you.
Do you consider regular brick-and-mortar savings banks to be incompetent when they freeze someone's personal account for receiving business amounts of money into it? Because they all do, every last one. Because, again, they expect you to open a business account if you're going to do business; and they look at anything resembling "business transactions" happening in a personal account through the lens of fraud rather than the lens of "I just didn't realize I should open a business account."
And nobody thinks this is odd, or out-of-the-ordinary.
Do you consider municipal governments to be incompetent when they tell people that they have to get their single-family dwelling rezoned as mixed-use, before they can conduct business out of it? Or for assuming that anyone who is conducting business (having a constant stream of visitors at all hours) out of a residentially-zoned property, is likely engaging in some kind of illegal business (drug sales, prostitution, etc) rather than just being a cafe who didn't realize you can't run a cafe on residential zoning?
If so, I don't think many people would agree with you. (Most would argue that municipal governments suppress real, good businesses by not issuing the required rezoning permits, but that's a separate issue.)
There being an automatic level of hair-trigger suspicion against you on the part of powerful bureaucracies — unless and until you proactively provide those bureaucracies enough information about yourself and your activities for the bureaucracies to form a mental model of your motivations that makes your actions predictable to them — is just part of living in a society.
Heck, it's just a part of dealing with people who don't know you. Anthropologists suggest that the whole reason we developed greeting gestures like shaking hands (esp. the full version where you pull each-other in and use your other arms to pat one-another on the back) is to force both parties to prove to the other that they're not holding a readied weapon behind their backs.
---
> Are you warned about the risks in an active war one? Yes. Does Google warn you about this when you sign up? No.
As a neutral third party to a conflict, do you expect the parties in the conflict to warn you about the risks upon attempting to step into the war zone? Do you expect them to put up the equivalent of police tape saying "war zone past this point, do not cross"?
This is not what happens. There is no such tape. The first warning you get from the belligerents themselves of getting near either side's trenches in an active war zone, is running face-first into the guarded outpost/checkpoint put there to prevent flanking/supply-chain attacks. And at that point, you're already in the "having to talk yourself out of being shot" point in the flowchart.
It has always been the expectation that civilian settlements outside of the conflict zone will act of their own volition to inform you of the danger, and stop you from going anywhere near the front lines of the conflict. By word-of-mouth; by media reporting in newspapers and on the radio; by municipal governments putting up barriers preventing civilians from even heading down roads that would lead to the war zone. Heck, if a conflict just started "up the road", and you're going that way while everyone's headed back the other way, you'll almost always eventually be flagged to pull over by some kind stranger who realizes you might not know, and so wants to warn you that the only thing you'll get by going that way is shot.
---
Of course, this is all just a metaphor; the "war" between infrastructure companies and malicious actors is not the same kind of hot war with two legible "sides." (To be pedantic, it's more like the "war" between an incumbent state and a constant stream of unaffiliated domestic terrorists, such as happens during the ongoing only-partially-successful suppression of a populist revolution.)
But the metaphor holds: just like it's not a military's job to teach you that military forces will suspect that you're a spy if you approach a war zone in plainclothes; and just like it's not a bank's job to teach you that banks will suspect that you're a money launderer if you start regularly receiving $100k deposits into your personal account; and just like it's not a city government's job to teach you that they'll suspect you're running a bordello out of your home if you have people visiting your residentially-zoned property 24hrs a day... it's not Google's job to teach you that the world is full of people that try to abuse Internet infrastructure to illegal ends for profit; and that they'll suspect you're one of those people, if you just show up with your personal Google account and start doing some of the things those people do.
Rather, in all of these cases, it is the job of the people who teach you about life — parents, teachers, business mentors, etc — to explain to you the dangers of living in society. Knowing to not use your personal account for business, is as much a component of "web safety" as knowing to not give out details of your personal identity is. It's "Internet literacy", just like understanding that all news has some kind of bias due to its source is "media literacy."
But I'll rephrase it, if you can't read the less-charitable interpretation between the lines:
99.99% of personal users who have any GCP resources, either don't realize they have them and don't care (the Google Apps Script case — shutting off those resources is immaterial to them), or they are actively-malicious users trying to set up bunches of Google accounts to use GCP free-tier promotional resource spend to run VMs to join into botnets to DDoS people with / sell into commercial VPN layers / send spam with / etc.
Every IaaS, VPS, bare-metal host, etc. treats their individual users like shit, because the same "easy on-ramp" that marketing departments argue for means that there's no KYC process to deduplicate users by their true identity, and so nothing standing in the way of a user coming back over and over (through residential VPNs, with generated $1-limit credit cards) to make new accounts, get the promotional credits, and spend them on whatever, before vanishing into the night without paying.
Due to this, individual user accounts — ones with running resources, who may very well be businesses too stupid to register as businesses! — must be able to be terminated with extreme prejudice, with no human veto. Because a human veto is too slow compared to the speed and scale at which these attackers can operate; and so the literal only other option (under the constraint of allowing that easy on-ramp) is that the entire service gets consumed by a botnet, and the QoS for paying customers drops to zero.
It just-so-happens that Google is both an IaaS and a consumer web services company. But that just ramps up this existing incentive higher: the median YouTube-TOS-violator is some kind of comment spammer; and that user account is likely also taking advantage of GCP promotional credit to run the very bot that is posting the spam comments. If Google bans you because they think you're spamming YouTube comments, then why wouldn't they also assume that any GCP resources you're using are involved in operating a comment-spam bot? That's the pattern they've seen — millions of times by now, given that these register-an-account-and-provision-GCP-resources workflows have themselves been automated by the attackers.
And again, none of this happens if you actually go through the explicit KYC process involved in signing up for Google Workspace + signing up to GCP as a business + setting up an org Billing Account. Because then you no longer look like a random malicious attacker; you look like a business customer. And business customers get the benefit of the doubt.
> You're holding it wrong
Imagine you're a doctor in an active war zone. People could shoot at you, but they don't, because they can tell you're a doctor. But they can tell only because you dress a certain recognizable way — showing recognizable symbols of your profession and purpose there (prominent Red Cross symbol, etc.)
There is, in fact, a wrong way to demonstrate that you are a humanitarian non-combatant in a warzone. (That being: failing to even attempt to do anything to signal it until after people already have guns pointed at you.)
And, insofar as malicious actors vs hosting providers is also a kind of active war zone — one where your account could catch a stray bullet by mistake — there is in fact a wrong way to signal that you are not one of the belligerents. (That being: failing to even attempt to make yourself and your business known in detail to the hosting provider as a distinct entity to be recognized and treated as a B2B customer, until after they already close your account for a TOS violation.)