Yes, this is usually the more common story - Google does a lot of things to protect users (from themselves, and from external attack). I suspect a lot of people who get locked out are for fairly pedestrian reasons like password reuse across sites, and they got hijacked. It sucks, but it's better than the alternative (e.g. somebody pilfers all your email and commits identity theft).

Trust me, there are a lot of bad actors out there,

The other poster had it right - 2FA is really the way to go, ideally with something like Google Authenticator or Yubikeys.

If you ever get locked out (e.g. account is suspected as compromised/hijacked), then:

https://accounts.google.com/signin/recovery

is your one-stop shop to prove you're really you.