Isn't this more like an exploit which allows an attacker to send a phishing email from google's domain? They've hacked google's chatbot to send the attack vector. There's no way to justify it, google's behavior here is just crazy. User interaction isn't really the issue, it's that the attacker has appropriated google's brand to gain the user's trust. You'd think that might be something a company would care about? These are super weird times we're living in.