Yes. And spam filters aren’t hand picked and written. Haven’t been for a few decades. They’re learning and statistical.
Like another comment said, the mails are hitting some traffic rules and having correlations in their text with phishing scams or something that pushes their score to the negative enough to “warn the user” level but not enough to file as spam or reject completely.
Also, even if “Google knows it’s a legitimate company”, it’s somewhere between stupidly hard and impossible to tell if an email came from that company. And again, nobody would keep a hand curated list of “legitimate companies” and their email for an ever growing list of companies. Even if that was possible to do.