That's for a responsible user and an up-to-date browser, just using the web version of the apps. Of course a user could receive malware via GMail or stored/shared from a compromised computer or with compromised credentials in Google Drive. Google does provide a Google Talk plugin and a Google Drive client, and it's possible that a back-door has been placed in one of those. Furthermore, if a user does a web search for "download gmail client" or "download google drive client" or "download browser for gmail" and clicks the wrong link, they might get malware instead.
The bigger worry about allowing users in a secure environment to be checking their web-mail (from any provider) or accessing files on a cloud service is that it's easy for them to share the organization's data and information without proper controls. The network as such is beside the point, what really makes something a security breach is the secrets.