GCLB Missing SameSite and Secure Flags
Potentially this is related to different feature requests for Google Cloud Load Balancer.
Feature for allowing users to update/edit response header with External HTTP(S) Load Balancing
Using session_affinity cookie with SameSite attribute
Ability to set the session cookie as Secure when using Generated cookie session affinity
In my personal experience, GCP support mentions that this is tracked by their develop team and there is no ETA for applying them, this based on Feature Request doc.