This is pretty serious and the fact it's turned into a story is one of the more damaging things you could expect to see about Google w.r.t. privacy. SREs are indeed very privileged and in many cases have carte blanche on their associated products. It's saddening one of them used his rights for nefarious purposes and broke some of the trust around Google's handling of personal data. I hope this leads to better auditing at least internally - seems like something that better transparency of access would have brought to light earlier.