> Nearly all the value is in the staff who are all free to walk if they feel inclined.
That hasn't been my experience with security services companies. Sure, people matter, but the processes, technology, and leadership can keep a good one on track regardless of who leaves.
Google is well known for the acquihire. They aren't Berkshire Hathaway, they aren't just assembling a portfolio of companies. They have their own product plans, and generally buy out other companies as a way to get pre-built teams with the right specialties to accomplish that.
Also, it's very unlikely Google wants to be in the incident response consulting space: Google entirely hates any line of business that can't be automated into a smooth profit paste. Flying security professionals out to clients isn't in their DNA.