It would be better if Google would react more strongly to such attacks. -> There is a sophisticated one where you can take over an account via the Account Reco

It would be better if Google would react more strongly to such attacks. -> There is a sophisticated one where you can take over an account via the Account Recovery flow, that is still actively abused; tried to report, got "not a bug, triaging as abuse risk"