So the crux of the problem seems to be that Google synced the employee's MFA codes to the cloud, resulting in all of them being exposed once his account was com

So the crux of the problem seems to be that Google synced the employee's MFA codes to the cloud, resulting in all of them being exposed once his account was compromised. This is ironic seeing as how historically impossible Google made it to back up your codes to your own hardware. It's why I refuse to use any Authenticator app that doesn't provide that feature. I'm sorry Google, but you don't own my secrets: I do. I don't want them to be locked away under some hardware-fused seed unless I generated it. Saw a similar dark pattern with the deprication of the adb backup API's in Android, where apps are silently skipped (0 byte output) with no warning to the user. Google has effectively made it impossible to back up your phone to any cloud but theirs, to the point where customers of solutions like SeedVault have asked devs to impersonate device-to-device transfers as a workaround to beat the allowBackup manifest flag. We have a real problem with the concept of ownership in this age, stemming from an arrogant and incorrect "we know best" attitude at tech conglomerates.