For some reason this only just now occurred to me: What’s to stop some web site from carefully crafting an imitation of the Google “you need to sign in again” UI, storing your Google password, and storing from the other side the auth cookie from Google, so that it can then poke around through 100% of your Google content including any other site you’ve signed into with the same SSO login?
This is such a fundamental flaw in the whole concept that it’s obviously occurred to people and they’ve had time to come up with something to prevent it, but I can’t see how you could prevent it. Have I missed something? You might have a non-Google URL in the address bar during the faked sign-in, or you could use varying degrees of deception to attempt to make the address bar look legit, but I’d honestly be surprised if more than 20% of people even check the address bar every time they sign in to SSO. I don’t.
So what’s to make this not work?
I only once got a real security notice from Google and this was several years ago, before Covid even. It simply stated that a (correct) login attempt was made, but from an IP address in China, and Google blocked this by default because it was “suspicious”.
I changed all my passwords and have never had a problem since, but I agree with your scenario. There’s ample stories of people even having 2FA set up and still getting locked out from their own accounts, although I suspect the grand majority of these cases are through social engineering rather than actual hacking.