"It's open source" isn't the full story. Something can be open source and also used in a harmful way. You're right that gRPC-Web alone isn't a huge issue, but it's part of a larger trend of Google wanting to Google-fy the web, technology, or even society as a whole (see the leaked Selfish Ledger and Good Censor presentations).

Specifically in the case of gRPC-Web, even though "it's open source", does every gRPC service exposed on the web provide a .proto file for you to build your own client? If not, that's a big step down in terms of power given to end-users compared to REST.