I’m with @codinghorror: this isn’t a bug.
Consider the difference in response headers from the two requests:
$ wget -O /dev/null -S https://xkcd.com/123 |& grep Cache-Control
Cache-Control: max-age=300
Cache-Control: max-age=300
$ wget -O /dev/null -S https://goo.gl/maps/R6nj3Qwf2LR2 |& grep Cache-Control
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Cache-Control: private
Cache-Control: no-cache, must-revalidate
(There are multiple headers because of redirects being followed)
It would be a bug if the onebox library cached data when the origin said not to. The other way around… not so much.