That’s something I’ve been worried about since I switched to a custom domain email address that I point to another mail service: I protect my registrar account with 2fa, but I still think that the chances of someone hacking via social engineering my DNS registrar (Gandi) or the MX provider are much higher than someone hacking my 2fa personal @gmail.com account. I might just be paranoid.