Comment by jddj

In practice it's maybe slightly harder, because they'd have to convince a user to enter their google 2fa code into a site that isn't obviously google?

I'd imagine a convincing enough modal would do the trick though, in a lot of cases.