It is silly, as I think that is disabled if you have "Advanced Protection" turned on. Which... is what I thought they now called 2-step. Seems it is 2-step+?
So, yeah, "Advanced Protection" offerings would be good. Looks like I could make my own app that uses open id to connect?
If you have a plain gmail account (instead of Google Workspace, or whatever it's called now), one irritating thing is that you have to renew the access tokens (using oauth2create) once a week.