It's not a serious vulnerability, at least in the commonly understood sense of the word in security. It is phishing and spoofing, as Google accurately describes

It's not a serious vulnerability, at least in the commonly understood sense of the word in security. It is phishing and spoofing, as Google accurately describes in their response. Maybe it's functionality for Google to change to prevent social engineering for susceptible users, but it's not something that deserves a bug bounty.