This is going to depend on whether those services act as independent controllers, or as your data processors.
If they are separate controllers, then you need a legal basis for sharing your user's personal data with them, which happens e.g. by loading content from their services. This legal basis will typically be consent, and will typically be implemented in a click-to-load fashion, where the functionality initially has a placeholder that asks for consent, and is later replaced with the embedded content if consent is given. You are not responsible for the independent controller's privacy practices, though. You are not the data controller for the services' logfiles.
If they are your data processors, then things are very different. You are not sharing your users personal data with another service, you are processing personal data under your authority, and have merely outsourced some aspects of these activities. If a data processor maintains logfiles, these are your logfiles that they just maintain on your behalf. You would be fully responsible for them, including, if appropriate, by facilitating the exercise of data subject rights like access or erasure.
Since you cannot delegate responsibility for compliance to your data processors, you should only engage data processors where you are confident that using their services allows you to be fully GDPR-compliant. Before integrating their services, you might evaluate what data will actually be processed, whether this is necessary for your purposes, how you can configure the data processing activities, and how you can fulfil data subject rights with regards to these processing activities. For example, a service provider might offer a data protection dashboard where you can export or delete user data, if that service provider wants to make it easy to use their services in a GDPR-compliant manner.
Even if engaging the service as a data processor, you will need a legal basis for the actual processing activity. This might be consent (opt-in), or a different legal basis like a legitimate interest, in which case an opt-out may be required. When consent is revoked or a legitimate interest is objected to, past processing activities remain lawful. Whether past data will have to be deleted depends on context.
Whether or not an "account" was created on your backend is a red herring. If you can identify the data subject's information on the backend, they can exercise their data subject rights. This is possible without an account e.g. if pseudonymous client IDs are used. However, you are not required to keep identifying data just for GDPR purposes (see Art 11). If it is not possible for you to locate the data subject's records, then the data subject rights like access and erasure don't apply.
Personal tip for Google services: Google offers a wide variety of services under very different terms. You will have to investigate those services on a case by case basis. For some such as Maps, Google will be the data controller. For other such as Crashlytics, Google will act as a processor. But as of 2023, Google does not guarantee for most of its services that personal data will only be processed in the EU or in countries with an adequate level of data protection. This can make it extremely tricky (or outright impossible) to use their services in a GDPR-compliant manner. Sometimes the use of such possibly-noncompliant services can still be a valid business decision, but the safer approach would be to avoid Google services whenever possible. Crashlytics is closely related to the Analytics product, for which some European data protection authorities have explicitly stated that it cannot be used in a compliant manner.
