I think you're on point with the malicious compliance. Google doesn't want to give up power and control. Requiring all installations to run through them seems to be their workaround.