Similar story here. Had G-Suite Legacy for my domain from many years. I was using two secondary accounts like a data archive - rarely logged in, just old files

Similar story here. Had G-Suite Legacy for my domain from many years. I was using two secondary accounts like a data archive - rarely logged in, just old files stored in their GDrive spaces. Found out last month that Google makes it impossible to log in to these old accounts. Username/password says there's something suspicious and sends a OTP to my mobile number. Even after entering the right OTP, still calls it suspicious and suggests to log in "at a later time." Even as the site administrator, I found no way to bypass this. I suspended and restored the accounts. I reset their passwords. I tried to turn off the suspicious login detection in policies (...not allowed). Basically, Google elevates its bot to a super site admin that can't be reasoned with. I ended up deleting each account, opting to transfer their GDrive data into site admin account during deletion. Then kept that data far away from anything Google now. Given my experience, I'm reluctant to upgrade to Google Workspace. Makes me wonder how less tech-savvy site owners are coping with such problems.