>by an employee whose job it was to do exactly this kind of thing..

I think this is the crux of the issue and people are making up the facts they don't have to fit a narrative.

There is a reasonable difference between security notifications and other corporate policies.

Were any non-security notifications in scope for their job or the tool used?

Is there precedent for google flagging specific external websites with HR policy notices?