While THAT may be an example of a SIMPLE attack, probably for the sake of showing off, what if "the goog" had exposed web services retrievable by Ajax for logged in users as part of AppEngine and THAT was exploited via the SIMPLE XSS hack?

It makes no sense. Why do we just brush stuff under the rug when it's Google or some other major player that's generally well liked?