This isn't a surprise. Google is a huge company with probably hundreds of teams working on these things. The fact that the privacy settings can be figured out at all is a bit of a miracle. I doubt the privacy settings are "designed" as much as it is a bunch of disparate teams working on it together with maybe somebody coordinating it.
Google is a trillion dollar company that employs some of the best software developers on earth. I have zero sympathy. Sort your shit out or prepare to have hostile regulators take a bat to your business model.
It seems the primary question worth considering now is what regulators are to do in response.