"Attacking" is maybe too strong of an accusation, because for that they would need to be looking for weaknesses in websites and exploiting them. That's too obvious, and as a monopolist Google has way more covert options at it's disposal.

For instance, they may gently bias search results so sites that are not CAPTCHA protected appear more in queries made by bots, and less in those made by humans.

Another thing that has become way more prevalent since the AI bubble, is that scrapers indexing your site are sometimes indistinguishable from a DDoS attack. For this one, Google sells no solution, but Cloudflare does. Now, Cloudflare will not be DDoSing sites not covered by their service, but I have no doubt that they themselves are scraping all the public traffic, and selling it to all the AI companies. That way, scrapers know they don't have to scrape protected sites, and focus their efforts on unprotected ones.