I really don't get why Google doesn't have the option to serve these requests from the website's domain (maybe even using a random subdomain each time).

Considering Google has their own CA or could use Let's Encrypt, it should be more than feasible.