Note that there is no question who owns the account. That's what the password is for!
I'd be surprised if that was true. They don't just consult me about MFA, they downright pester me about it.
Besides if you wait long enough Google unlock the account anyway (if it's due to suspicious logins). I know, because it happened to me. I don't know how long it took, all I know is when I happen to check a few months after I thought I had lost access to the account, I could login again.
Finally, it's not like they have a choice. They have to protect the reputation of their domains and servers. It may seem unfair that you cop it if there are security issues, but you got the account for free and you refused to use the numerous MFA options the provide. If someone nerfarious takes over an accout to distribute spam or malware there is a mess that costs time and money to clean up.
There is a real point to be made about how Google / Microsoft and friends message accounts. But it's hard to sympathise with complaints about free ones. Paid for ones, where they promised a certain level of service and then withdraw service without warning and without the ability to recover your data (as I think happened to to the ICC) is a different matter.
This should probably be the case - I am not a big fan of passkeys [1] but hopefully this will help make non-SMS, phishing resistant MFA available to the masses.
Still, Google are in a difficult position where on the one hand they have people angry about being locked out, and yet if they didn't they would have people angry about their accounts being compromised.
> If that means my account gets compromised, that's my problem.
It is also the problem of everyone on your contacts list, the operators of other services which use Google OAuth for login, anyone who might recieve spam from your compromised account, and so on.
Reducing harm by temporarily restricting the account when heuristics indicate it may be compromised is not unreasonable IMO.
>Note that there is no question who owns the account. That's what the password is for!
This is unfortunately not as true as we would like it to be.
Have a look at the list of compromised services on Have I Been Pwned [2] - not all of these include passwords, and many that do would be hashed (and hopefully salted) rather than plaintext, but it still happens often enough to be of great concern.
[1] WebAuthN / Passkey technology is fine in the general sense, and I am quite happy to use it with a hardware security key (such a Yubikey or Titan) or emulated in a password manager.
However I think the recent push towards having it tied to a TPM on a device such as a phone is a bit short-sighted, simply because these devices are prone to being lost or damaged. If you set up passkey MFA on the phone and don't enrol a backup method, then lose your phone, you have also lost the account. Probably these services should require 2+ MFA methods configured.