..including any private data they can gather on you, via search, maps, analytics, browser..

I wouldn't put it past Google to be already indexing exposed databases (or continue indexing ftp), just not making it publicly available.

Between MongoDB, Jenkins and Elasticsearch, thats a whole ecosystem of pwnability that is probably just starting to be exploited.