Defining a good Content-Security-Policy for an existing complex application is often non-trivial. It's safe to say that efforts are underway to deploy CSP at Google, but imagine the cost of potential breakages on such a site. Also keep in mind that some users would not benefit from a CSP, due to using older browsers, so other defenses must still exist.
Referrer-policy is actually undesirable on a search engine. Many web site operators use the referrer to determine what keywords were used to access their site, which helps optimize their site content and better understand their userbase to generate more relevant content.
X-Content-Type-Options is not used for most browsers, and even when it is, it only matters if an attacker can control a significant part of the beginning of the response.
I understand the principles of defense in depth, but obviously security doesn't exist in a vacuum and has to consider operational and business aspects. As @LvB pointed out, security headers on a search page are very different from properties with higher sensitivities, such as accounts.google.com and mail.google.com, both of which score an A.
(All of this is just speculation and I don't know what the official answer is.)