I think the point was that if any company should have awareness of what internal tools are pointing web servers at the outside world, should be capable of audit

I think the point was that if any company should have awareness of what internal tools are pointing web servers at the outside world, should be capable of auditing its own security, should easily understand what that software is doing and how it should be secured, it should be Google, a company whose primary output is web software.