google.com is a valuable target for XSS attacks. Keeping content off this domain reduces the attack surface.

I too think this is the reason. It does, however, allow for cool domains like https://summerofcode.withgoogle.com

This kind of marketing content is often provided by an agency. Hosting it on google.com where users are logged in would require extremely strict security reviews.

It's the domain they use when an engineering team doesn't make the website; this was probably made by a marketing team, so it doesn't go on google.com.

It gives a partnership vibe, in contrast to the default "we are using you" one.