I guess one way to protect yourself from this would be to use another IAM solution for SSO login to Google Workspace, but is there any reasonable choice for small businesses other than Entra ID or Okta?
edit: looks like there are affordable managed hosting providers for keycloak.
Not sure the state of keycloak now, but it was a lot of work to manage keycloak configs with the IaC pipeline. That could have gotten better now, but I think having access to the data is important because migration might not be trivial if for instance a provider starts acting up.