A lot of people hate this answer, but do not entrust Google, Yahoo^H^H^H^H^HOath, or any other big free service with gatekeeper status to anything financial or, really, anything more important than chatting with pals. Host it with someone trustworthy; if that is not you or someone you personally trust, then someone you pay, who will listen to your instructions to, say, never change credentials over the phone, or however you wish to structure it.
> And you tell me this was to protect me?
...In the same sense that the managers of public buildings' preference for you to piss yourself in public over cleaning formerly public restrooms is "for your protection".
But in 2011, no 2FA existed yet, so the old account had none. I had mostly forgotten about it.
Still, I didn't want anyone using it to spam to friends, family, etc in my name.
I recently had an issue where a hijacker, from another country, was able to take over my account and change the password, without access to the backup email, the SMS, or anything except the password.
Google even mailed me a warning that this user from another country was accessing the account, and changing the password.
When I tried to get it restored – I knew the phone number (but had no access anymore because the number was reassigned to another person), had the old password, access to backup email, knew the content of emails on the account, etc – I was denied.
It was easier to get the user who got my old number, contact them, and go together with them through all the steps to get the account back.
To top it even off, after I had contacted Google support about this originally, they never contacted me back – instead, once I recovered the account, I found that instead they had talked with the hijacker.
And you tell me this was to protect me? Honestly, fuck that.