This is a big "duh" to me and I see very little value in this post. As far as Google's control extends, I can't think of anything they could implement without

This is a big "duh" to me and I see very little value in this post. As far as Google's control extends, I can't think of anything they could implement without flaws that wouldn't be hostile to most of their end users. If it weren't this flaw, it'd be a "zomg, I can plug a USB key into Alice's computer and install a keylogger". This is a trivial, routine style of attack and of course it will work against Google's security scheme which is catered towards the everyday Joe and Alice and designed more to protect against phishing. A better scheme where if you lost your phone, you lose your data forever, would not pass muster with everyday users.