A malicious developer trying to phish in that flow will just substitute a self-hosted or local simulation of the Google login form. That doesn't work because G

A malicious developer trying to phish in that flow will just substitute a self-hosted or local simulation of the Google login form. That doesn't work because Google login is multi-step. Just stealing a password isn't enough, then you need to log in with it. They have anti-hacking systems and two factor auth to stop that.