They aren't hosting user content; it was their pull request preview domains that was triggering it.

This is very clearly just bad code from Google.