I'm not sure if you have used Google Apps before, but from memory it has DNS and website verification, so I can only assume it'd be vulnerable to this sort of attack.
Let's face it, being able to serve content on a website at all is enough to prove you own it these days.
This might be a large investment for the engine itself, but minimal investment for the game. In my experience, the largest, buggiest and most complicated parts of a game are all contained within the engine.
I believe the 20 percent improvement in perf and engagement alone justifies the effort. Otherwise, the choice of React in this instance is great because you can fail quickly (easy to learn + very easy to start integrating), therefore being able to stop blowouts before they arise.
Let's face it, being able to serve content on a website at all is enough to prove you own it these days.