Office 365 does that too - and Twitter by the way... Copying & pasting URL is becoming mostly a tedious rigmarole of opening the link, seeing what it finally resolves to - and only then copying & pasting...

Which advantages does Advanced Protection give you in particular so that you have enabled it? It seems that things like hardware 2fA should work without it as well? Genuinely curious.

It forbids 2FA with anything other than U2F hardware, which is practically unphishable. I don't really trust the Google auth system without the hard "disallow all non-hardware-based auth" restriction, due to the innumerable stories about sim swapping, et c.

Fair point! Didn't know there was no other way of enabling this.

I am on it and like it. It seems to explicitly forbid a bunch of edge cases in the login auth that would otherwise be tricky to configure properly and keep up to date. Yes, you can set up and use hardware key auth without it, but it's nice to guarantee that you can never login without a hardware key no matter what. IIRC it closes off a few other types of misconfiguration or over-authorization that might allow someone to exfiltrate data from your account.