Well, Google continues to have the profit motivation of selling people’s personal data, whilst the way black hats turn into white hats is that they can make more money (or at least safer) by helping to improve security rather than break it.

You don’t really hire an active black hat to do penetration testing into your system when they can make way more money selling what they’ll find in your system than what you’re paying them for said penetration testing.

The problem is that Google’s core business is still built-around using (and selling, though indirectly) people’s private data.