Odd that google's device could comply with all of the industry standard best practices, home automation regulation, code audits, licensing requirements, and privacy guarantees and yet still have such a bug.
What regulations? What guarantees? There really aren't any at this point. As for 'best practices' that's a laugh, sadly. Home Automation has been all over the maps, for decades now, and it's not looking like it'll stabilize much any time soon. This is, perhaps, a good thing, in that innovation continues to occur when things are in disarray. A patchwork of various pieces from different vendors might seem inconvenient, but that also brings along a lot of diverse approaches and innovation. I'll trade that against dominant market player arrogance any time. Nice to have options, even nicer to have the suppliers fighting each other through innovation.
"That's the joke."(TM)
Ah, good sir, you are asking some good questions. Best not go any further, if you know what I mean :)