It's not a security incident because it makes Google money. It's extra revenue. They are embarrassed all the way to the bank.

At some point, when it appeared 2 months ago on HN and they still did nothing about it, intentionality can be assumed.

This is exactly it - and the normal "resolution" is a class-action lawsuit but no doubt their terms and conditions forbid that.

However, anyone affected should probably pollute their docket with lawsuits anyway.