It appears to be a CYA move by google. A penetration test, clear detailed information about usage of user data, and it is done by separate contractors. I would hope they allow more contractors in the future.
Yep this is a common move a lot of companies are doing for their biz partners and customers are requiring these sorts of tests be done before getting final procurement sign-off.