Browsers and CDNs both read cache headers, but they are not the same audience. A page that is private for a browser can still be a disaster if the CDN treats it as public. Set headers on purpose, then let Cloud CDN honour or override them with distribution policy.
Public, private and no-store
public means an intermediary may store the response. private means only the browser should. no-store means do not keep a copy. Authenticated HTML should not be public at the CDN.
If your framework sets no-store on everything, the CDN becomes a TLS proxy and you have paid for a cache you never fill.
max-age versus s-maxage
max-age talks to browsers. s-maxage talks to shared caches such as a CDN. Use a long s-maxage on hashed JS, and a shorter one on HTML you intend to purge.
Cloud CDN also lets you set TTLs on the distribution so origin headers are not the only control.
Validators are not a substitute for purge
ETags and Last-Modified help revalidation. They do not push a new HTML shell to 210+ PoPs the moment you deploy. Purge the URL or change the filename.
Versioned assets with a content hash can keep a long TTL forever. The HTML that points at those hashes cannot.
