I can see why Google would not require G Suite customers to set up DKIM, but why do they not have it set up for google.com? It seems like it would have added another barrier of defense in the case of this bug.
[1] You'd need permissions to enumerate the entire DKIM zone of the domain which you wouldn't have for a random domain and whilst you could by to bruteforce all selector names combinations between 1 and 63 characters long I wouldn't recommend doing so.