In fairness to Google, the one mechanism that isn't vulnerable to phishing is the one that Google put a lot of work into designing, implementing, standardizing, and evangelizing, and the others were existing and easy-to-implement options.
> Now there are 4 ways to compromise your account.
No, there's 1 way which existed with just the email/password. But it's reduced by the number of people who do realise it's not the right page.
They also support FIDO/U2F, which does the site verification for you, and 2nd device auth which I don't believe you can trigger from a spoofed site.
Just ignore the fact that almost every option is vulnerable to real time MitM via phishing if a user doesn't understand they're at the wrong URL. So what does Google do? They deemphasize the URL and train users to randomly enter their 2FA codes everywhere a million times per day. Brilliant!