The identity checks also introduce their own vulnerabilities, in the form of social engineering where there wasn't an escalation route before. Solutions like y

The identity checks also introduce their own vulnerabilities, in the form of social engineering where there wasn't an escalation route before. Solutions like yubikeys and passkeys theoretically solve this problem, but open other problems: not least what if you lose the key or the device that the passkey is stored on? Then you're no longer you as far as the authenticating party (Google in this case) is concerned. What's more, whoever stole your phone is you as far as they care, because that's all they have to say who is who. Your devices should require further authentication (password/biometrics) but is that a guarantee? Could Google or anyone else really guarantee that any client device connecting to their service is unhackable, bearing in mind that many of their users may be on cheaply made and fully out-of-support Android devices or Windows XP? It's a really hard problem to solve.