I believe them. If you're going to use a malicious certificate to spoof traffic, you'd be pretty dumb to start by targeting Google, since all their properties are pinned in Chrome. You'll just get caught.
Also, using X.509 CA=YES certificates to mint new certificates on the fly is a standard and legitimate feature of corporate network hardware. In virtually every large enterprise network, employees don't have direct access to the Internet; they bounce through proxy servers. The middleboxes that make this work all have "upload a root CA cert here" features to make this work.
That they accidentally issued a malicious certificate, I think, makes things a little worse from my vantage point. There are a million ways to get hacked, but not as many excuses for just being sloppy.
Also, using X.509 CA=YES certificates to mint new certificates on the fly is a standard and legitimate feature of corporate network hardware. In virtually every large enterprise network, employees don't have direct access to the Internet; they bounce through proxy servers. The middleboxes that make this work all have "upload a root CA cert here" features to make this work.
That they accidentally issued a malicious certificate, I think, makes things a little worse from my vantage point. There are a million ways to get hacked, but not as many excuses for just being sloppy.