For sites like Google, this is either a calculated risk, or not even applicable for them. Scanner services like Mozilla Observatory / securityheaders.io / Qual

For sites like Google, this is either a calculated risk, or not even applicable for them. Scanner services like Mozilla Observatory / securityheaders.io / Qualys / etc only test a preset list of known best practices, they can't judge whether that technique is applicable for that site. While it's usually good practice to follow the recommendations of such scanning services, you must always make sure you understand the implications.