The licenses (from major foundries/vendors) are indeed usually quite restrictive; however, the hard part has always been enforcing them. It's not surprising to me that Google hasn't built any guardrails around this.
After all, gating by IP address? What happens if someone from the marketing team logs on from an airport? All of the slides revert to Arial?
The access would presumably need to be done through a VPN to have the fonts.