The problem with making it a crime (it probably already is a crime) is that the blame will be placed on the developer when it probably was not the fault of the developer.

In these types of situations I’ve been in, usually the developers already complained, and it’s really not the fault of the developers.

This creates this weird situation where developers have to do more and more to protect themselves from situations like this.

It doesn’t take more than a few seconds of thinking to realise that google should have made some kind of way for authentication to be transitioned over. Even something as simple as sending out a “transfer” email link or even just an api that squat space could have called to allow customer transfer verification.