> The one thing I never understood about these warnings is how they don't run afoul of libel laws.

I’m not a lawyer, but this hasn’t ever been taken to court, has it? It might qualify as libel.

I know of no such cases, and would love to know if someone finds one.

I worked for a company who had this happen to an internal development domain, not exposed to the public internet. (We were doing security research on our own software, so we had a pentest payload hosted on one of those domains as part of a reproduction case for a vulnerability we were developing a fix for.)

Our lawyers spoke to Google's lawyers privately, and our domains got added to a whitelist at Google.

you only sue somebody poorer than you

It depends, if it's a clear-cut case, then in jurisdictions with a functioning legal system it can be feasible to sue.

Likewise, if it's a fuckup that just needs to be put in front of someone who cares, a lawsuit is actually a surprisingly effective way of doing that. This moves your problem from "annoying customer support interaction that's best dealt with by stonewalling" into "legal says we HAVE to fix this".