Google is the biggest security risk for a lot of people since a lot of people throw their whole lives on Google - Google has to defend against literally the most dedicated attackers trying to hack political officials and fortune 500 executives alike. It's obvious that, at their scale, they're going to have a lot of false negatives and false positives. Even a 99.99% success rate of detecting fraud would mean millions of false positives or negatives locking people out of their account or allowing illegitimate actors into accounts. It's also the reason why they don't have general account support besides an account recovery process that only sends requests to humans under very specific circumstances: humans are bound to have an even worse success rate than the machines at preventing illegitimate access.

I think it's obvious that Google is too big, but it's not like they can help it. Capitalism in the internet age requires constant growth if you want to maintain your company's value, which is a large part of why they can't turn people away from their service. The best they can do is require a phone number to sign up and limit the number of accounts a phone number can be associated with (which they already do).