We don’t know yet that that’s what actually happened in this case.

It seems likelier than a @google.com spoof landing in the person’s inbox.

Without them providing the headers this is just idle guessing, but I’d argue my guess is likelier to be the truth.