But then just don’t use google authentication and instead one of the FOSS alternatives? Aegis comes to mind.

Like the original reply to your situation said, you do you - but this seems a weird threat model to me, extra-step point notwithstanding.