So a couple possibilities come to mind:

1. Someone else has your password. Do you have kids and do they have access to devices which may have your Google account linked? You may want to change your password (use something long, hard to guess and unique).
2. Your local system is compromised in some way. This would be a really odd way for someone to use that access, but it’s always possible. Take a look at the apps and any browser extensions you have installed and make sure there isn’t anything you don’t recognize.
3. There is some sort of Cross Site Scripting (XSS) vulnerability which is being leveraged to subscribe you to stuff. I would expect Google to be better than to have an XSS on YouTube (they bought Mandiant a while ago, FFS). But, big companies doing stupid things is common enough. When you got the pop-up, was it in the YouTube app or a web browser. Did you have other tabs open? Other background processes from sketchy apps?
4. It is Google, them doing shitty things to their product (that’s you) for their customers (the advertisers paying for your eyeballs) is basically their business model. Don’t like it, de-google your life (warning: this is actually really hard).