This attack is absolutely the Google's fault, here is why (most to least severe): 1. Password/2FA change must require reauthentication 2. Session tokens must

This attack is absolutely the Google's fault, here is why (most to least severe): 1. Password/2FA change must require reauthentication 2. Session tokens must be limited to a single browser fingerprint (broser/device specific infomation) 3. Changing the password must terminate all active sessions 4. Session termination must invalidate session token for future use 5. It must be trivial to the user to terminate all active sessions 6. Serious actions like changing account handler/main info must require reauthentication Any of the first 3 would've made such attack impossible. Any of the first 5 would've made regaining full access to the account trivial as a single button press.