isn’t that still, by defnition, a breach of the company’s data?

In a sense, kind of. But it doesn’t demonstrate penetration of infrastructure built and maintained by Google. So there’s perhaps a judgment issue, but not a demonstration of their own security capabilities being compromised.