Google's response said that their software does not depend on the vulnerable packages (this is consistent with the researcher only seeing downloads from dev machines and not from automated builds). Reading between the lines, I'm guessing that there is a big human element in play and it's simply not something that the security team can fix. If engineers insist on manually downloading packages insecurely, there is only so much the security team can do because "Googlers can download and run arbitrary code on their machines". (I think that's what they tried to convey by "social engineering" -- not that the researcher was using social engineering, but that there is a social aspect.)