It's actually slightly worse, because it is forced sharing! The recipient doesn't have to accept an invite -someone can just share a google doc with you and it will be visible in your drive. It's like sending someone an email (which is another attack vector this could have been triggered)