> Didn't she inject code into an unrelated internal extension?
Depending on your definition of code, that's probably not the case. She added an entry to a config file that contained a mapping of urls to messages. Such as:
dropbox.com/upload -> Friendly reminder: please don't upload internal documents to dropbox
Also, Google generally trusts engineers and it's not that unusual to have an engineer writing and deploying code. So essentially it was her job to work on and deploy this extension. I believe that had the message been an April fools day joke she wouldn't have been fired.
So in my opinion arguments that others have made (not you) that: "this was a unauthorized code change therefore obviously she should be fired on security grounds and charged with violating the CFAA too, it doesn't matter what the message was" don't really hold water. There's also an argument that she used some sort of "emergency" deployment mechanism, but that doesn't really hold water either. Honestly it's not that unusual to see people deploy some package when they need it rather than wait for a scheduled job to deploy it.
I think the grey area she was operating in boils down to: She had a platform to distribute certain types of messages internally and she put a message in there that probably wasn't the normal type of message distributed. If I were her manager I probably would have taken some action but it wouldn't have been firing.