From my experience most of these defences take the form of limiting privileges and implementing the four eye principle. Consider the fact he could take over 15

From my experience most of these defences take the form of limiting privileges and implementing the four eye principle. Consider the fact he could take over 15 Google developers systems within a few weeks with little effort. What if there's two people who can approve each other's production deployments, etc.? Even if you only take over one developer's system, it's a great starting point for pivoting into the network and starting a more sophisticated attack. I'm sure an advanced threat actor would know how to take advantage of the opportunity against Google.