Since Google themselves claim that's a security check, there's a bug bounty here.

The author of that article missed their chance making Google eat their words.

Or he missed the chance to get Google to move that check to the back end and then when it is time to renew find out that he cannot, if he’s lucky enough for it to not break earlier.

I was under the impression Google engineers went through a rigorous hiring process, yet this is the sort of thing you get from lowest bidder consultants who have inexperienced devs.

Nah Google and Microsoft have been offshoring to India for years. And sorry, but the developers there suck.

All that leetcode, whiteboarding, and Googly-style interview questions just to put front-end validation for security.

This seems like something more intended to avoid a bunch of pointless attempted signups from people who don't understand what having a domain means who then won't be able to do the later step where you verify that you actually own it.

A client-side check's not so unreasonable for that kind of thing.

Of course then you still want the list to be accurate and/or actually have some working support flow that results in an overzealous filter getting fixed. The code suggests that they do or did have a process at some point: the list of specific domains is an override that allows domains that would otherwise match one of the regexes and get blocked.

Yeah but they said it was important security.