Stealing Your Private YouTube Videos, One Frame at a Time
a bug like this suggest that Google services infrastructure isn't based on identity propagation, and instead services have full access to other services, and  access control and authorization checks are performed in the client service.