Yes, they do. They've got CalDAV at https://apidata.googleusercontent.com/caldav/v2/calid/events and https://apidata.googleusercontent.com/caldav/v2/calid/user, and CardDAV discoverable through https://www.googleapis.com/.well-known/carddav.
Does it really? I think it just shows that you didn't know about something they offer, and decided to attribute that to them being malicious.