This is indeed a sophisticated and alarming attack, but…

> the attacker shuffled my staked ETH and other tokens through multiple transactions, then drained the account.

Live by the decentralized, irreversible, climate-destroying, scam-and-slavery-enabling currency, die by the decentralized, irreversible, climate-destroying, scam-and-slavery-enabling currency.

> Google enabled Authenticator cloud sync by default.

Adding that to the list of reasons I use FreeOTP instead (https://f-droid.org/en/packages/org.fedorahosted.freeotp)