Google is aware and has enabled DNSSEC on their recursive resolvers for a long time. Unfortunately, most people do not DNSSEC sign their zones, so Google have

Google is aware and has enabled DNSSEC on their recursive resolvers for a long time. Unfortunately, most people do not DNSSEC sign their zones, so Google have to resort to also enabling 0x20, which is helpful, but also (to an extent) security theater.