Private Google access allows your instances to reach Google APIs and services using an internal IP address rather than a public IP address. ... You can enable Private Google access on a subnet level and any VMs on that subnet can access Google APIs by using their internal IP address.

How does this work anyway?

All Google did was add a PRIVATE IP to the public services (like Cloud Run, Cloud Functions...)