Following your logic, I would expect my bank to be hacked way more than the few careless customers of the bank itself who leak their credentials via stupid phishing attacks, since the returns are many orders of magnitude higher?

I’m not sure it works that way, incentives are always balanced by the practical effort required to achieve the goal, and the effort of breaking google is massive compared to the effort of violating a DNS registrar.