Long answer: It would be impossible for them to distinguish between content that is safe to reproduce publicly. Judging from how they reacted to the ToS and other dings against their public image, they are working too hard to protect that image than to risk something like this nonsense. And lastly, they have had this power with Google Toolbar forever and haven't done it yet.
One thing I could see them doing is having a separate opt-in service for web apps, something akin to OS X's Spotlight or Google Desktop Search.
I'm not sure what they're trying to say, but they don't seem to be talking about indexing your own private data for you.
How can password-protected data not be user-specific? If the web application writers want to make certain data public, they already do this - for example, my Facebook profile is indexed by Google, but the messages I see when I log in aren't.