Well, Google’s willingness to pay potential competitors tens of billions of dollars per year to disincentivize developing a competing search engine is kind of a moat.

Their moat is lock-in across services now. People are "Google" users not just "web search" users.

Google is still good enough for most searches. Say finding web page of restaurant or some cursory information on popular topic.

I suppose competitor would have to be really good on those times most users need something better.

So it is the brand and familiarity. It would need to get really bad even on most basic things to be replaced.