Earlier quoted context omitted.
They can use onclick and leave the href attribute alone.
I'm sure this is something they have considered as their own analytics program uses onclick to track outbound traffic - I assume it's a mix of speed, reliability and the ability to track without javascript. Plus, if it was done on OnClick there would definitely be an add-on to disable the tracking on all browsers.
A direct link from a search page will let websites see the search terms that users entered in to navigate there.
Google still knows everything so it doesn't protect you from them, but websites are more in the dark what users were doing before clicking the link.