> Record actual sessions (mouse movement, clicks, typing)

> I gasped when I realised I can actually capture all form submissions and send them to my own email.

How many bad actors have been doing the same and for how long? This doesn't sound like something Google should just brush under the carpet and expect no one else is doing it. Although I wish the author had reached out to Google first to see how they would have handled it, I thank him for publishing it.