Not excusing their dark patterns (which don't play nice if you block double-click at DNS level, but just as an observation, googleusercontent.com itself is actu

Not excusing their dark patterns (which don't play nice if you block double-click at DNS level, but just as an observation, googleusercontent.com itself is actually a legitimate and valid (at least IMO) security precaution. By serving up all user generated content from a separate domain, it gives defense-in-depth against any kind of uploaded content getting script execution - it's served up from a domain that is completely separate from any authentication tokens or valuable cookies etc. That way, a user-uploaded HTML file (if someone found an endpoint that would render it) shouldn't be able to be served up from a first-party domain.