Also—maybe getting hacked is worse, maybe loosing access is worse... but who are you to make that decision? Google can set the default, but the user should be able to decide on the balance that's appropriate for them.
The aversion to 2FA makes them seem like easy targets if I'm looking for addresses to use for spam.
> maybe getting hacked is worse, or maybe loosing access is worse, but the user should have the right to make that decision
Getting hacked makes losing access considerably more likely. This ain't one or the other.
If you want to spam people, why not just sign up for your own gmail account?
It's a terrible place to be in, but isn't nowhere as bad as being a homeless person with no access to HN and Twitter, having Google delete your account and nowhere to complain about. Because that is even worse.