The fact people can get session jacked by Google, though, is still wild. Linus explained that their access control granularity is woefully underdeveloped, especially for such a large company.

Google and especially Youtube seem to be run in a reckless, careless and incompetent way in this regard. Similar to Youtube seemingly being uninterested in solving the huge comment scam problem. I don't buy that the company that successfully filters out billions of spam messages in Gmail can't detect these really obvious spam/scam comments on Youtube. It's just baffling.