Each production IP address has a unique hostname, which is predictable, consistent, deterministic, and entirely useless to anyone but a few engineers who I suspect can read these addresses like a map. These names matter a lot to those people; but for the rest of us we just care that it doesn't create new problems.
That's where the XSS comes in, because domain names matter a lot in security. On the web, a domain name is a security boundary. Cookies, browser objects, and other resources are shared freely within a domain but can't cross that boundary without certain provisions. So if each address had a hostname ending in "google.com" or "youtube.com" or any other domain that has associated web resources, then theoretically an attacker could request a resource that normally would be outside of the trusted domain, but which is also accessible through the IP's assigned hostname.
Rather than finding and fixing all such potential issues, a safer solution is to put the hostnames on their own unique domain which is never used for any other purpose and therefore can't harbor unwanted surprises.
It's also interesting to note that not all of Google's IPs use 1e100.net. Addresses under user control like those assigned to Google Compute instances resolve back to a name ending in googleusercontent.com.
Disclaimer: I work for Google.
Reclaimer: This is not an official Google response. I don't speak for Google. These thoughts and opinions are my own, and don't reflect those of my employer, my congressman, or the 80's rock band, Toto.
