That is true especially if your sessions are made very short, which requires the more expensive Google Workspace edition. But if sessions are long, the risk is users lose access to their 2FA and don't notice until it becomes a bigger problem...