Why would I, as a end user, be given to trust this if I think Google employees are snooping in my files? I have no way to audit how this is kept, so I'd have to assume that any Googler snooping these files is either doing so using a backchannel that is not audited or the log is a no-op.
If your worry is Google, as an organization, is actively trying to steal your stuff, that's one thing. If your worry is a rogue google employee is doing some unsanctioned thing, that's another. This (imo) mostly helps with the second, unless you also assume that Google as an organization is fairly inept and so can't log things reliably.
The likelihood a company like Google is reading your emails directly and trying to scoop your business on a product idea or something like that is slim. The likelihood they are profiling your communications in aggregate and producing derivative information like "how many companies in the space are considering hiring" or "do the employees at this company talk about Chipotle" and using that for advertising or data products is, I would guess, pretty high.
I wouldn’t trust a company with personal data while their main business model depends on violating your privacy, just like you wouldn’t trust an alcoholic with guarding a warehouse full of vodka.
The only way to be somewhat sure is to deal with companies that have zero uses for your personal data - this will not mitigate the risk of a malicious employee poking around but will at least mitigate the risk of large-scale data misuse like ad targeting because there’s simply no ads to target and no infrastructure to do so.
Edit: from the privacy policy:
> No. There are no ads in G Suite Services or Google Cloud Platform, and we have no plans to change this in the future. We do not scan for advertising purposes in Gmail or other G Suite services. Google does not collect or use data in G Suite services for advertising purposes.
There's both a risk of accidentally misusing data given the two services share infrastructure and code, as well as a business incentive to commit such "accidents", especially given both Facebook and Twitter set a precedent that there's absolutely no downside in doing so.
Government action that I'm left in the dark over.
If the government is interested in something from my mail servers, I'll see the legal request or judges orders and will know what is going on, and will be able to take appropriate action.
If the government makes appropriate legal threats against Google, I won't necessarily know (National Security Letters) until long after the fact.
Or the mail servers of the person/people you're communicating with. At which point you wouldn't know, because they'd be subject to the same laws, and less well equipped to fight them.
But I don't think most people's threat model includes the US government. Probably not even most news organizations.
At the end of the day, you want to trust that your provider isn't out to get you, otherwise why are you even a customer (Oracle gets a free pass, because reasons). However, you want to know that they're serious about their claims, and transparency in their tools and processes is a big part of that.