> is there hard evidence of misuse of Gmail user data?

Yes, the Snowden leaks.

It doesn't matter whether Google themselves takes privacy seriously, they are a US company and therefor when handling personal information we must always assume that everything that is uploaded to their servers is sent straight to the NSA as well. Because that's what US law allows for.

I'm not even exaggerating, according to the latest rulings by EDPB, storing personal information on US servers is pretty much always forbidden unless you store it in encrypted form and control the encryption key.