Literally never happened before, but same way they know a credit charge is fraudulent, I tell them.

The reason I brought this up is because I read a story of a European guy who had someone pay for something in Brazil using his card, through GPay. He didn't get his money back, as the bank didn't believe him (as GPay is supposed to be secure). Take this with a grain of salt though, as I can't find this story now.

Also if someone found a 0-day in GPay I wouldn't be the only one complaining of fraudulent charges, they'd be flooded with complaints.

Not necessarily. Maybe a company like Pegasus is already exploiting a 0-day to see the purchase history of people, but they're smart enough to not attract attention by stealing.