This was a common complaint in Alexa and one interesting bit of insider information I found out from people that either left for Google Assistant or came from there is that their tools did not have this level of pain around data security. As a result I'm guessing there's a middle ground between customer data security and making it impossible to work with - either that, or Google just didn't care.
To be honest, I'm just going off the other commenter's testimony; I would have presumed that their internal data access control policies would be... minimal, to be generous. The fact that developers couldn't get access to data to the point that they noticed and it was painful sounds like a genuine good step in the right direction, though.
There is a point that there should be a way of gatekeeping this in a maximally efficient and accountable way but setting the standard of "Access Control" as being that there's friction to gain access seems like a no brainer.