One could even say that their need to breach protocol to unionise is a violation on google's part in the first place. It should be incredibly easy to unionise.
Security breaches are convenient as cause: If rules are sufficiently byzantine, everyone breaches them at some point or another. “Security breach” also sounds bad enough that few will question the decision to fire. “But everyone does it.” is no defense against an alleged security breach. Whether the rules actually increase security doesn’t matter.
Security is personal. Very few people in companies don't violate exposing their user sessions to others unattended, which is a security breach. With GDPR, such lax security may carry million dollar fines, and prison time.
And even though the security risk from the laptop being unattended in the car for less than 60 seconds is a violation, if someone was so determined to get my laptop within that kind of a timespan, they'd be determined enough to grab it off of me in person. So the practical security risk there is zero, but you could still grill my ass for it.
First, practically any information revealed can be considered security breach even if you just forward a meeting invite with a list of coworkers to your private email or you talked to your friend at a party about what you do at work. This is all explicitly, prominently prohibited by contract (not a google employee but any large corporation I worked did that).
Second, company can avoid releasing too much information about it exactly because it is security matter.
Third, there is usually good track of evidence and it is easy to find. Just look at the mail the person sent outside the company and look for anything they should not be revealing (ie. almost any information).
Fourth, there needs to be no precedent for firing employees for security incidents. Companies do that regularly for valid reasons. And yet as or even more frequently, they decide not to react, also for valid reasons.
Richelieu