I have no idea, but I guess it doesn't really matter. If you start sending massive amounts of spam through gmail, does it matter if you did it after logging into the site with your user/password or through oauth api access or through smtp?

Correct, or until this week they had a pool of "anonymous" accounts you could use instead, until those were banned

It doesn't. There is an option to log in anonymously, which uses one of several dozen "dummy" accounts operated by Aurora maintainers to sign in. As of late these dummy accounts have been getting rate limited, leading to anonymous aurora sessions not working as expected.

A commonly suggested workaround is creating your own personal dummy account used for nothing but signing into Aurora. Google first rate limiting Aurora's dummy accounts and then beginning to instaban personal dummy accounts is significant because it represents an escalation in their efforts to force all Android users into proprietary walled gardens (Play store).

It doesn't, there is an anonymous account option. (It sometimes breaks for a bit, but I've been quite happy with it)

Google requires it, for no apparent reason other than their anti-competitive practices.

Or you could install an Android fork that removes Google's control.

However, after installing that, you still may decide you want to install your bank's app.

That's one part where I actually think it works the way it should: for instance chinese makers probably don't keep any single trace of Google stuff in their builds, and they sell pretty big volumes.