Any mail client in the wild today will support STARTTLS and won't submit any credentials to Gmail until a TLS connection has been established. If your connecti

Any mail client in the wild today will support STARTTLS and won't submit any credentials to Gmail until a TLS connection has been established. If your connection is MITM'd and you accept the bad certificate error or your laptop is totally pwnd, you're screwed regardless of how you're authenticating. In those situations an attacker could still hijack sessions, exfil data, act on your behalf, etc regardless of whether you went through their browser auth flow with MFA.