It would seem Google account details have been compromised or otherwise correlated, with not a peep from Google, we are getting reports of scam calls to people's real phone numbers about the "business opportunity" available in their attached Youtube properties.

Another possibility is advertising shadow profiles are able to correlate logged in accounts across YouTube and other properties.

Is this the point where most tech people accept that anything a closed source Software company says about security is effectively a "Trust me bro" as long as it is not backed up by independent verification?

We love to talk rubbish about finance bros but that industry has had independent auditing as part of its DNA for a century[1]

[1]: https://en.wikipedia.org/wiki/Sarbanes%E2%80%93Oxley_Act