Was this codebase audited by a security company?

Yes, it was audited as per Google CASA (Cloud Application Security Assessment). This is an annual requirement.

The email scope is essentially the most restricted OAuth scope Google has, so the audit is pretty intense.