I don't know what you can do for immediate action, but usually Google does reverse their domain safety status quickly after the offending content is removed. 72 hours might be enough for this to go away.
Also, this is bound to happen in the future where people are going to link to malware that’s hosted elsewhere.
I’m trying to wrap my head around how to mitigate the risk of the entire site being blocked vs a single subdomain.
Will update here though when it is resolved in case there are any lessons to be shared with folks
In this case it would be tricky since the link is to google drive and we can’t block those. Also we’ve seen people work around url blocks by either using short links or by using html pages hosted for free to redirect using JS instead of an HTTP redirect. Always another mole to whack :,)
Maybe allow your customer to use their own domain? Sites that host user generated contents such as wiki, blog or personal page often offer this option.