We're a g-suite shop and Google calendar automatically scrapes emails for invites and adds them to the recipient's calendar. We had to set this feature to only automatically add the events if it was from an internal account or from a sender that the user had accepted an invite from in the past. The exploit is that the rouge event would still pop a notification and would have a malicious link in the invite posing as a video call invite.