I suppose, on paper, you're more vulnerable to Google employees or contractors using internal access to steal identities, but is that a problem in practice (if so, I'd love pointers)? Or are Google's internal security measures and controls effective in preventing it?
Meanwhile, Google's done more than most companies to protect the information they have from third-party attacks (HTTPS, two-factor authentication, certificate pinning, and so on), probably partly because it is so important to their business model. Apple, on the other hand, has often been slow to implement new security features out of concerns it will compromise the user experience, leading to well-known breaches like this one: http://www.wired.com/2012/08/apple-amazon-mat-honan-hacking/