Now, a scammer is trying to access your e-mail account. What level of proof do you want them to have to offer Google to get ahold of that e-mail?
These tech companies are not asking for an "unreasonable view" into your life as long as people are using these products to interact with the real world. They are trying to strike a balance between convenience and security that meets real-world needs. And they are trying to set that balance point somewhere where it works reasonably for the majority of their non-technical users, not for the edge-cases and not for people who think LARPing as a 90's cyberpunk novel is the most important usecase. So, yes, so long as the vast majority of GMail users are using their GMail account in a number of ways that intersect with the real-world financial system, they are going to want some way to verify your real-world identity if you lose the log-in credentials to your account.
If you need to reset your bank credentials (not solely a password - some form of second factor is universally required), it can't happen electronically without involving the real world; either you come to a branch with proper ID or you get mailed them to your registered physical address.
I mean, no matter what you do, you have to have some root of trust / root of identity, and it needs to be backed by (and verified in) the physical world - so you either have to do it yourself or delegate it to someone whom you'd trust a lot (i.e. not a random email provider). If a trustworthy universal government ID is available (which is a problem in some places, like USA) then that is a natural solution to that.
Alternatively, an institution is free to trust people remotely, putting effort into fraud monitoring, and taking on whatever risk their trust and processes enable - e.g. we've had some financial institutions verifying passports over videochat in such cases; I have no strong opinion on how safe or risky that is, but presumably the institution has considered the risks very carefully and found them both acceptable and necessary (in that case, sending a scan/photo/picture of the same document was not allowed, it was specifically about live videochat) - which is the key part of the whole thing, the alignment of incentives and responsibility for that risk.
If the consequences of these security risks fall on the users, then the users have to worry about security while financial institutions just wiggle their ears and blame "identity theft". If the consequences fall on the institutions, then the users can stop worrying about the things they mostly can't influence, and the institutions magically design their processes and workflows carefully so that they actually prevent fraud (since it's their own money at stake) and they're forced to implement decent solutions to any tradeoff between usability and security, since their profits depend on both.
Incidentally, in my country, there is a government-mandated (everyone has it) single sign-on solution that companies can use if they want to really know who someone is. The implementation isn't perfect and unfortunately they're starting to nudge people into using an app (that can only come from an app store, creating a sort of catch-22) instead of one-time pads, and there's a lot to complain about there. But I think the principle is completely reasonable, that just like we have passports, birth certificates etc., governments absolutely need to enter the digital era and provide modern forms of identity services. This is yet another area where everything moving to the internet has led to privatization through the back door, and I fear the world where some American company can turn me into a digital unperson much more than one in which my government can.
I've seen this before too. A huge problem right now is the massive tech companies want an unreasonable view into your life. They want your identity, phone number, photo id, location history, credit history, etc. before they'll treat you like a real person.
If you think I'm joking, spin up a transient environment, connect to a VPN, and try to participate online without linking all of your accounts to a piece of real world identity information that, in turn, can be linked to all the other things I listed above. You can't even get an email address without a phone number.
Part of the issue there is the huge tech companies are abusing their market positions to assign bad reputation to the IP blocks owned by everyone else. You can't use a VPS for ANYTHING but incoming connections because the IPs are flagged all by Google et al. How do you run an API server that needs to make any outbound connections if Google, Facebook, Microsoft, etc. all consider the IP block tainted? I guess you just need to buy your IPs from Google, right?
That's exactly the same tactic Google used with GMail. The original spam filtering was super aggressive and shitty and the solution, according to Google, was to use GMail instead of other providers. "Get a big provider" is a very poor answer to a question that has a technical solution IMO.
> My mailserver is marked as spam by gmail
Have you tried GSuite (or whatever they're calling it these days)? /s