[jasonkostempski]

This is going to make gmail accounts a huge target for thieves. Now they don't even have to do the reset password step on your bank login.

[phsource]

To be honest, I think email accounts (especially the main ones) have always been a huge target to thieves, since many services still use it as the primary password reset/two-factor authentication method. In that sense, not much has changed.

[theseanstewart]

Google should require that 2FA is enabled to use this feature.