Emails then bounce to no-reply@ and any legitimate email client will auto-populate support@ as the To address when the user clicks reply.
Also PayPal was a contributor to DMARC RFC, so they presumably know what they're doing too around e-mail, wouldn't you say?
I get confirmations of flight reservations where env-From is mandrill app and From is kiwi.com. DMARC passes. Some of my banks do this, too. Registrar of my domains does this. Many others too.
It's just not suspicious and these are very important senders to me (I mean I'd hate to fail to renew my domain, or miss that one-in-a-lifetime e-mail that someone is withdrawing money from my bank account other than me, because of a braindead SPAM policy) and google should not care.