The licenses (from major foundries/vendors) are indeed usually quite restrictive; however, the hard part has always been enforcing them. It's not surprising to me that Google hasn't built any guardrails around this.

After all, gating by IP address? What happens if someone from the marketing team logs on from an airport? All of the slides revert to Arial?

This is an architectural problem. These companies share their documents with externals, and the documents must behave normally to these externals. So it doesn't just have to look as intended, the external person also needs to be able to edit the documents with the CI fonts available.

One could imagine that access to the fonts could be restricted to the logged-in user, but that would mean that public documents that can be accessed without a login wouldn't have the specific fonts.

Google would sooner turn off the feature than build some convoluted solution to protect a custom brand font. It's a problem that's not worth solving.

I can just as easily download them from any of the brand's official websites. The vast majority are being utilized via font-face and are rendering inside of heading and body text.

Convenient WOFF format, all weights, and available in 2 clicks in Dev Tools. And if Dev Tools is too difficult there are dozens of free extensions that will do it for you.

I'd argue that what little Google provides now is more secure than the official websites' usage.