This is a relevant issue but I haven't seen this discuss here so: If you want to minimize or practically eliminate the Google account lock-out risk and also el

This is a relevant issue but I haven't seen this discuss here so: If you want to minimize or practically eliminate the Google account lock-out risk and also eliminate any hijacking risks, register multiple hardware security keys (FIDO keys), remove all phone-based 2nd factor or backup, and make sure your password is something you won't forget (it doesn't have to be very strong - as long as it's unique), and register for Google's Advanced Protection. Because there is no known attack against hardware security keys, there has been no broad attack - which means heuristic-based defense is not necessary. The heuristic based defense is a necessary evil - it's the source of false positive lockouts, but necessary since otherwise credential stuffing attacks can't be controlled / reduced. You want at least two security keys, preferably 3 (one with your primary device like laptop, one personally with you e.g. in your key ring, and one stored at home, preferably in a fire-proof safe - alternatively you can leave your security key at work if you're ok with that exposure). You really want redundancy - as much as you fear lock-out, you should never lose access to at least one of your security keys. If any of the security keys get stolen, you can immediately de-register and get a new one to replace it. You want to get rid of SMS or phone-based 2nd factor, since phone hijacking is a realistic threat. You also don't want OTP as it's phishable, and is more difficult to maintain high availability (you lose one device you registered as OTP and you're doomed).