These don't feel like good ideas, but I'll throw them out until someone comes along with something better.

A lot of countries have a government website where you can report online fraud, e.g. https://reportfraud.ftc.gov/ . Perhaps they will have a step where they contact Google and the account gets locked to require further authentication?

Perhaps you could try logging in from a lot of different IP addresses, e.g. through a VPN, and Google might lock the account to the stage which a lot of people inadvertently reach, where a 2nd authentication factor is needed, such as a previously used device or SMS.

Edit: I assume you have tried to contact Google anyway?