I can't agree. This guidance just pushes responsibility down onto application developers and I would expect most of them to either do nothing or implement guidance inconsistently.

The right thing here is to offer APIs that fit the needs of the applications that will use them with as little extra responsibility as possible.

In this case, I'd have hoped that Google would set email_verified to false so that applications (or downstream IDPs) would know that they had to do extra verification.