Lol I remember seeing this timeout issue years ago and immediately deciding I would never use Go for HTTP (which is what it was designed for). This makes Go vulnerable to numerous slow attacks and there's no way around it besides "use a proxy".

My guess as to why this issue is left open? Google has global timeouts set on all the network edges so they don't want each service to use its own. Whats good for Google overrides whats good for the supposedly open source project.

This is pervasive in most of their projects. Google open source is like the Reapers from Mass Effect series. They leave some crumbs behind to ensure the software ecosystem develops along desired paths. Not out of charity, they do it to ensure a successful harvest.