If they're relying on binaries from Google, then it's already compromised.