I'm well aware of that. But this was not a (submission) peer review situation. From everything I've seen (not a complete picture of course) this was a process entirely separate from the peer review process of the conference she was submitting to. That still makes it a situation where her paper was apparently reviewed (and possibly by peers) but it certainly doesn't have the same semantics in which anonymity is warranted/guaranteed.
But the feedback itself wasn't shared with her. That part doesn't make sense unless management didn't want her to see it, and why would that be the case?
Because (a) by the rules of engagement, management is not required to share original feedback, and (b) the original feedback could be used to identify the sources. In this case, there might have been a real risk to the sources given the individual in question is known to mobilize internal and external forces like Twitter mobs to personally attack people and bully them into submission.
I think this argument would stand on its own without the very specific claims about the person in question, which are a little strong unless you have personal information.
This is internal legal review, not academic peer review.
I'm not sure we know exactly what kind of review it is. I think it also depends what she signed up for, explicitly or implicitly. What were the expectations around freedom to publish?
It is a review that every paper submitted to a conference or a journal from Google has to go through. In fact I believe one has to do that prior to even submitting the paper to external peer review. That at least was the interpretation every researcher I knew at Google was operating under.