I'd say that's because Google is primarily a marketing firm. Something like 95% of their revenue is from marketing / advertising.

It's not in their best interest to go "above and beyond" in protecting personal data.