But do they though? Does project zero review all products made by google on top of the rest of the web? I doubt their oversight happens at the silicon designing stages. Maybe once it's out they battle test it, but I doubt it'd happen before that.
Project Zero is a tiny subset of Google's security team. And while they do have an unusual concentration of extremely competent security researchers, it's not like they are the only competent security researchers/engineers in the company. Similar research happens internally, at all levels of the stack, including designing silicon (e.g. Titan chips that were shown publicly).
Its possible the Project Zero team consults or throws ideas to other teams. It is possible Google is able to recruit additional people of similar caliber for the silicon design teams.
