Their "API" isn't what's being accessed here. As far as I understand it's using their subscription account oauth token in some third party app that's the issue here.
If they allowed oauth token to work like that then that is their (Google's) problem.
If they allowed oauth token to work like that then that is their (Google's) problem.