Thanks for the tips Doug.
I added an "applicationId" suffix to my debug buildType, and created a new app (in the same project) in Firebase with the debug package name. Now when you re-download google-services.json, it includes the necessary data for all your Android apps in the one file. This let's you place it in your main app module, so you don't have to create a debug src folder.
I have one followup question now:
Is the inclusion of all clients in google-services.json being deprecated now that the plugin searches each build variant for that file? It seemed redundant to place the same file in each build variant if it's exactly the same.