I switched to Google Domains a while ago for personal use. It's a bummer that yet another important thing is centralized in my Google account, but seeing as Goo

I switched to Google Domains a while ago for personal use. It's a bummer that yet another important thing is centralized in my Google account, but seeing as Google already handles critical things (email --> account resets), I don't introduce an additional vulnerability by hosting my domains with them. Hopefully, by now, their two factor situation is sufficient, and their manual processes of sending scans of passports undergoes sufficient scrutiny. Anybody have any information on this? How strong is Google account security these days?