I was locked out of my 10+ year old google account for daring to use IMAP to access gmail from unknown networks and ignoring the "is this you?" emails for a while. I'd all but given up on it until I got a brand new Pixel a couple years back, I figured I'd try logging in with the last password I remembered working and it just worked, no complaints from the RFA. I guess the RFA requirements are completely dropped when logging in from a new phone to avoid people getting locked out as they're setting up their phone.