Don't forget hardware and hardware upgrades, facilities costs (desks, lights, etc), legal fees, licensing fees, rent, utilities, maintenance, development costs, etc, etc
All in addition to salaries and advertising.
What worries me more than Google is definitely the apps. Pretty sure most of the apps now ask for permission to read contacts, text messages, etc. It's all good and fine if it makes sense that the app needs that type of access...but why does a dictionary app need to know my location? I think it's these third parties we need to worry about more. I think Google needs to allow Android users to deny apps certain permissions.