As it turns out, letting anyone add files to your Drive account is bad.
Fifteen years after launching Google Docs and Sheets with file sharing, Google is adding what sounds like adequate safety controls to the feature. Google Drive (the file repository interface that contains your Docs, Sheets, and Slides files) is finally getting a spam folder and algorithmic spam filters, just like Gmail has. It sounds like the update will provide a way to limit Drive's unbelievably insecure behavior of allowing random people to add files to your Drive account without your consent or control.
Because Google essentially turned Drive file-sharing into email, Google Drive needs every spam control that Gmail has. Anyone with your email address can "share" a file with you, and a ton of spammers already have your email address. Previously, Drive assumed that all shared files were legitimate and wanted, with the only "control" being "security by obscurity" and hoping no one else knew your email address.
Drive shows any shared files in your shared documents folder, notifies you of the share on your phone, highlights the "new recent file" at the top of the Drive interface, lists the file in searches, and sends you an email about it, all without any indication that you know the file sharer at all. For years, some people in my life have been inundated with shared Google Drive files containing porn, ads, dating site scams, and malware. For a long time, there was nothing you could do to support affected users other than disabling Drive notifications, telling them to ignore the highlighted porn ads at the top of their Drive account, and warning them to never click on the "shared files" folder. (Sorry, Mom.)
Google acknowledged the problem in 2019 after a How-To Geek report highlighted a woman who couldn't stop an abusive ex-husband from sharing files with her via Drive. In 2021, Google added the first file-sharing control to Drive, giving the ability to block individual users. That's good for abusive people you know in real life, but it's nothing in the face of anonymous spammers that can spin up thousands of accounts in a second. At least Google was doing something after ignoring the problem for years.
With the spam folder, it sounds like Google is finally implementing the Gmail-style spam controls it needed on day one. Google's blog post says, "Similar to how the spam folder works in Gmail, automatic classifiers will redirect files that Drive strongly suspects to be unwanted to the spam folder. You will also be able to manually move Drive, Docs, Sheets, Slides, Sites, and Forms files in and out of the spam folder. After a file has resided within the spam folder for over 30 days, it will be permanently removed from Drive."
Now there are only two obvious missing features: the ability to limit sharing to your Gmail contacts (shouldn't this be the default?) and an option to turn off sharing altogether. Google says the controls will start rolling out this month.