In fairness to Google, the one mechanism that isn't vulnerable to phishing is the one that Google put a lot of work into designing, implementing, standardizing, and evangelizing, and the others were existing and easy-to-implement options.