I've never seen something download without actually being sent to a website before.
It is unlikely that you were not send to the destination site. Instead the destination was not rendered in the browser window, but only download. Thus from the user experience it looked like the download comes from the origin site (Google), while technically it comes from a third party site.
If a link gets actually rendered in the browser window depends on the content delivered through the link. If it is HTML, an image, a PDF or other types which the browser supports for displaying (video, audio, plain text, ...) it will be rendered in the browser window and the URL shown reflects the origin of the windows content.
Data which cannot be rendered will be downloaded though. In this case it will stay with the original window content and also the original URL is shown, but download the content. Thus it will from the user experience look like the download happened from the original site, even if the actual source is a third party site. A download can also be enforced by having a Content-Disposition: attachment; filename=... HTTP header in the HTTP response.
Interestingly, the page loads normally when loading on an OS other than Windows.
The HTTP request sends in the HTTP header information which can be used to find out the OS - check https://www.whatismybrowser.com/detect/what-http-headers-is-my-browser-sending. Also from the your IP address your rough location can be determined. This can be used by the target to customize which content to send in the response, i.e. make it OS and location specific. This is also used to trick early malware detection by making sure that the malicious content is not send to IP addresses which might be associated with scanners of security companies.
I submitted it to their safe site form a few days ago, but it's still there.
The information entered will need to be validated because otherwise somebody could use this to make Google block inconvenient sites. Verification will take some time, especially if the target deliberately tries to trick detection by sending malicious content only to some IP addresses and/or only from time to time.
