Google is the Scorpion in the parable of the frog and the scorpion - it cannot help its nature.
This is some of the most suspicious login activity imaginable. Nobody should be surprised if an account gets locked when you repeatedly try to access it from a new country and without your second factor.
Just keep an extra. Don't put all your eggs in one basket.
We have a home media server. Our important data automatically backs new files to a secure folder in there once a week. If I can do it, anyone can. And it could be done easily to an external drive or something that you plug in once a month. Anything. Anything at all.
Most companies have backups. There's a reason they do that.
How do I spread this risk and make it manageable? I have to give them some email address and I fear losing access to my email. And yes, I can lose my email address even if I have my email on my own domain. There are many failure modes for losing domain names. So how do I manage this risk?
For gmail, you risk account lockout like OP is experiencing. You can mitigate the risk with more recovery options at account.google.com like backup codes.
For a service other than gmail, I think the risks of lockout without customer service to help might possibly be less., especially if its paid like fastmail. If you do pay you have the risk of not wanting to pay anymore, or forgetting to pay, and if you don't pay you also have the risk of the service going away. I suppose the service going away is ok.
I for one am pretty confident google will keep gmail running as well as possible, so I see other services as a bit more risk there.
If you own the domain, you have paid for it and risk someone stealing it or grabbing it when you forget to pay. You can mitigate the risk by choosing a registrar with good security, paying for a longer term or not forgetting, eg a quarterly reminder to review your domain names. You also need to be able to access your registrar account. You can choose registrars you get other services from, like AWS Route 53 if you use amazon for anything, or Cloudflare for VPN, and mitigate the risk of non-payment or non-access because access and payment will be done more frequently.
Using your own domain is also more moving parts, decisions, setup, etc. So you risk more things going wrong or fatigue over all the maintenance taking over. How you weigh the monetary and complexity cost of using a domain name for email compared to the upside of control, having a personal site at your own name, etc.
While the crowd here can maintain a domain, that’s not a realistic option for most average people. In practice, most people’s digital lives can be lost or reset simply by messing up their primary email account. With extremely limited recovery options, after a certain point at least.
And domains can be lost too. Missed payments, error in administrating the domain, government takedowns. Many failure modes exist for domains too. Nothing in the digital world is permanent! That's why I find it disturbing that so much of our digital identities are tied to our email addresses.
There are alternatives that do e-mail, cloud storage, contacts and calendars if you're prepared to research them. I won't post a list but mention some categories of options: there are companies offering similar products (fastmail, proton), you can sometimes rent managed next/owncloud/e-mail such as exchange from some suppliers, or you can self host some or part of your needs (e.g. I know people who tailscale to NAS drives). My google account is only used for paid-for android apps, for example. I'm one of the self-hosters (but I keep an eye on the managed offerings from local companies). I don't use tailscale as I can wireguard to my router, but tailscale works well when you just want stuff that plugs in and works. Synology NAS drives apparently can be tailscale endpoints.
Ultimately, I try to avoid Google as much as possible and to a lesser extent other large cloud providers. This stems from exactly the kind of incidents the OP faces, along with the usual concerns about ads/tracking (and specifically not contributing to this as a business model).
You should always have backups, regardless of provider.
And note, I don't live in the US. I'm wondering about this question from a global perspective.
2. Use JMAP/IMAP or https://www.fastmail.help/hc/en-us/articles/360060590573-Dow... and keep a copy of all your mail locally.
Requires your own domain.
"Google is the Scorpion in the parable of the frog and the scorpion - it cannot help its nature."
The scorpion is not malicious in the scorpion and the frog fable. So what's your point?