To be fair, remote access to the user’s account on the machine is game over, regardless.

Knowing the password and having access to a trusted (don’t ask again for 30 days checkbox) device is possession of two factors.

Google offers stricter validation in the form of advanced protection, which isn’t so easily disabled.

https://landing.google.com/advancedprotection/