I have no love for Symantec but it doesn't feel right. I wonder if private negotiations have failed and this is Google trying to push the point?
Can you imagine if Mozilla tried the same stuff? I mean, they don't trust CACert any more after CACert wasn't able to verify itself (?) adequately, but this is on a different order of magnitude.
Compared to that, Google just forcing Symantec to be externally audited after it was shown that, not only have they issued wrong certificates, but also that they are unable to properly audit themselves, is being soft on them.
[1] https://blog.mozilla.org/security/2015/04/27/removing-e-guve...
If a browser vendor just kicked them out, users would abandon that browser - just imagine if 40% of your common websites stopped working.
And here is a thread about a Chinese government CA that mis-issued certificates for Google domains: https://groups.google.com/forum/#!topic/mozilla.dev.security...
Google's argumentation that Symantec apparantly isn't able to properly assess themselves seems sound to me: if after being told about a specific issue they still are not capable of finding all instances of it happening, while outsiders can do so with the published information, then they they are missing critical abilities in this regard.