By default, every project in GCP can talk to everything else in its project ... invariably by hiring a team of those same troglodytes, but the rest of us deeply appreciate not having a security model ...