First of all, open redirection is not a
serious vulnerability. Serious vulnerabilities include remote code execution, SQL injection and cross-slide scripting (depending on the context). Serious vulnerabilities can be used to compromise user accounts without their interaction. Vulnerability severity is always a bit of a touchy subject, but calling open redirection
serious is either hyperbolic or report-padding for security consultants.
Second, this vulnerability cannot be used to compromise user accounts or data, let alone with or without their interaction. It is a social engineering attack that could work, yes, but the Google Vulnerability Rewards Program is specifically designed to reward researchers for reporting technical security vulnerabilities, not those leveraged through social engineering.
Third, this is a rabbit hole. Google's core functionality is redirecting users to third party websites. You can just as easily send someone a link to a Google redirector that occurs in the browser when you click on a search result. It's not feasible to prevent this, and it's not feasible to prevent social engineering in general.
Bug bounty programs require a hard line somewhere in order to function. In order for an attack to be acceptable, it must have a clearly demonstrable foundation in a software implementation failure. It must be clearly defined as a logic error, not an error in human reasoning. The only cases where open redirection and social engineering are eligible are those where they are simply peripheral - an actual technical vulnerability that allows these attacks to scale far beyond manual means (an example might be a technical failure in Facebook's linkshim service).
I am disappointed in seeing that this story has risen to the top of the HN front page, because I believe there isn't a single security engineer here that would agree this is a technical vulnerability that should be eligible for a reward.