Um, except, they can? As clearly shown in the example link in the GP post:

https://www.google.com/url?q=https://example.com/

Google has had this open redirect forever afaict. I guess they don't consider that a serious threat.

I think the better answer is that this is tracking, just like they do on all of the search results, to see which links are most popular. There still might be a malware surveillance use case but that's not the only one.