Your risk assessment for items 1, 2, and 3 are basically accurate. If Google decides you're a scammer, it's real hard to rectify that assessment. And because the net of Google services is so wide, if they do decide to ban you, the ban is wide-reaching... Your access to YouTube, GMail, the entire Drive toolchain, the Play store, using Google as an identity broker for OAuth to other sites, etc. is compromised. And their automated systems will actively hunt for sock-puppet indicators and ban accounts they think are owned by the same person as the banned account.

Ironically, these two issues go hand-in-glove: because the reach of a Google account is so broad, they take the risk on compromise of an account extremely seriously. There's a reason they've been pushing people so hard on 2FA for years now; avoiding people falling prey to account compromise is much easier than rolling back the damage done if an account is flagged as a risk.

In practice, the odds of this stuff happening to you are low. It's like the risk of losing your house in a tornado... When it happens, it's disastrous. It happens rarely enough amortized across the population that people still live in Tornado Alley.

I can't decide for you how you feel about those datapoints on the risk model.