Defence is always more difficult than attack.
The defender has to think of everything but the attacker only has to find one exploit. It has always been thus.
That is not good enough reason for not trying to defend.
Google may actually be on the right side on this one. They gather a lot of personal data but do not seem to have a record of using zero day exploits to do it.