That's probably not quite true. "google3 file access" most likely means the ability to open paths with the "google3 file library", which lets you use paths like "/gfs/<cluster>/...", and similar for all the different storage services. But you'd also need an identity with permissions to read whatever you're reading. Without an identity that's in ACLs and stuff, you'd only be able to see "world-readable" data, which is still quite serious because who knows what's lying around, but probably nothing sensitive like source code.

What is "Google3"? Incidentally, Google isn't helpful in finding out - all I get as results is garbage and some node.js package placeholders.

Yeah, I wonder if the google3 access may have been the real reason they asked him to stop poking around.

Source? Is there really no authentication around it?