Whether it’s easily crackable or not doesn’t take away from the fact that it is 2FA. If someone broke into your computer and found a file called 2fa_setup_code

Whether it’s easily crackable or not doesn’t take away from the fact that it is 2FA. If someone broke into your computer and found a file called 2fa_setup_codes.txt and uploaded it to the internet, you’re still using 2FA. Just because the setup code is available for yourself or someone else to use doesn’t impact the technology. It’s still 2FA/MFA. This is exactly equivalent. And, sure, Google could do that. They certainly have the computing power to likely do that across their users. But what, exactly, is their incentive to do so? What makes this in any way shape or form realistic as opposed to paranoid delusions? And, I mean, just don’t sync your passkeys if you are concerned about this. It seems like entirely a manufactured problem.