Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
It's a Gmail feature. But note that this is invitations of events, not calendar subscriptions.
Note the last point where you can disable the feature.
If the calendar app is NOT scanning for events or invitations and adding it but allowing the email app, web browser or website or any app to have read and write permission in an sanbox app this would be huge problem on Apple part in OS.

If say any app can write to other app is not how iOS was built. The Gmail app, website or any app or browser should not have read or write permission to the calendar app or any app on the system.

Every thing is lock down and sanbox with iOS it not Windows 10 that can read and write access any where and allow you to save any where.

Now if it was a security vulnerability, hack or malware that is other story. But the way iOS is built one app should not be able to talk to other app. So I don’t know how this can happen.
 
I don’t believe that, unless there was absolutely no verification done this wouldn’t happen.
Then you will be surprised because not only it has been happening for years, it still happens and it will continue to happen until all carriers put in place better processes and stick to them.
In the case of my sister, as both carriers were totally unable or unwilling to explain how it happened, she filed a complain with the police. A policeman called the carriers and she could listen to the call. It was appalling: they could not explain how it happened, what ID proof was provided, not even where the change was asked, nothing!
Maybe your carrier is better (for example I read that Rogers in Canada changed its process a few years ago to avoid this problem: now it sends a SMS asking for confirmation in the next hour or so and cancels the change if the confirmation doesn’t come in time), but don’t expect everyone to be yet.
 
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.