[haakon]

Your understanding is correct. It happened to me; someone made a Workspace for a domain name I own, and made a user on that workspace to match an email address I have on that domain, and then used "Sign in with Google" on Dropbox. Luckily I don't use Dropbox, so instead of gaining access to my files there, it just resulted in a new Dropbox account being created.

I noticed all this, of course, because I got email notifications for all of it.