Tl;dr summary; the author spent some time investigating, found little except that the company used Google Cloud VMWare Envgine, and doubts that there was a bug on Google's side.
(I guess an investigative journalist could start interviewing staff promising anonymity)