Or an edge case they didn't consider, and will likely fix.

My bet was on a mix of just a predictable edge case and Google not prioritizing testing when users have stopped activity. I don't think they sat down and decided the kind of people who care about the inactive account manager were especially good targets for manipulation. I'm sort of surprised that they didn't use the info that they have on last logins instead of the web activity tracking, but there's probably some architectural reason it was easier.

Logins can occur without user interaction by a logged-in device, so it's not as meaningful as user activity.

That's true for apps & devices, but generally I think they can assume that a human is doing the logging in for one of their websites. If they can't assure themselves that it's mostly true they have a serious issue.

There are plenty of passwords managers that will do an auto-login. Anyway, the last time I've logged into my Google account is months ago - I only access it on trusted devices with long-lived sessions, and I suspect this is the case for most users.