There are ways to have passwords transmitted completely encrypted, but it involves hitting the backend for a challenge, then using that challenge to encrypt the password client side before sending. It still gets decrypted on the backend tho before hash and store.

But Google that high? I wouldn’t have expected as high considering Apple (another one who takes a cut of mobile gaming) isn’t.