Doesn't their change break supply chain security on Google's end?

With git tags, presumably people spoke in terms of cryptographic hashes. Now what prevents them from serving different Google drive contents to different accounts?