And I just found out recently that you can't log into Google on a desktop without responding to a prompt on your Android phone. Which, if you broke said phone, you can't do.

This is without 2fa enabled on my Google account.

There are a few alternate options like email or sms (I've used them several times, you have no option if you erase your only actively-used phone occasionally), but yeah. Google effectively forces 2FA whether you like it or not.

I don't think this is correct