The biggest problem with superfish was not the surveillance itself but instead that it broke SSL and thus exposed all "infected" systems to a plethora of attacks. Because Google controls both the operating system and the browser, installing a malicious certificate would not be necessary to achieve similar levels of surveillance.