I am not talking about malicious code contrary to Google's intention being ran on their infrastructure. I am talking about code that Google wants to run. Code that harvests DNS queries for ad targeting might be within Google's objectives and wouldn't be considered as malicious, but it would be malicious when looking at it from the user's point of view.
You're saying that Google has a plan to intentionally subvert their published privacy policy, and act which if discovered would end the company's existence, and that some engineer on the project wrote and another reviewed this change, that none of the dozens of privacy zealots in their internal privacy org[1] have managed to notice, and that the people who operate 8.8.8.8, some of whom are just as privacy-deranged as anyone you've ever met, and who collectively own a disturbing number of fedoras, kilts, and unicycles, who are the biggest nerds you've ever seen, happily run this service 24x7 without blowing the whistle?
Facebook has been caught doing that where phone numbers for 2FA purposes that were promised not to be used for ad targeting started being used for exactly that purpose. Facebook is of comparable size and operates within the same regulatory environment as Google, so if they can do it and get away with it there's no reason to believe it would be different for Google.
That’s basically ridiculous. Facebook is a corrupt organization. It was established to sexually harass young women. It was irredeemable from the beginning.