Or maybe google has listed IP for googlebot, and just whitelist googlebot useragents only from those IP?
Good idea, but Google doesn’t lis IPs. Only way to verify Google bot is by checking host:
This bots can even solve Cloudflare Challenge. I’ve added some ranges to CF firewall and they solved the googe captcha, because I can still see IPs from this range in my server logs.