To be fair its not just Google and amazon etc. I had a similar issue with my bank, they blocked a transaction in online banking which had pre requisites of logging in (three secrets effectively) plus sms verification, and specific sms verification for this transaction. unblocking it required only control of my phone number and knowing my date of birth and other easy to get info. If it had been a fraudulent transaction then the bad actor already had my sim card and ability to log into my account.

Serious question: is there any examples of a robust way of doing customer security? Even just a proposal/document or blog post (doesn't need to have been implemented). I sort of feel no one has figured this out yet (if its even possible).

Companies just need to make sure their insurers will pay out, which if there is not proven solution seems about all they can do.. tho a little humility and honesty that that is their position would go a long way.