If making changes to Google-side reach-out is actually possible, that's absolutely the far more realistic scenario here. My previous post is more of a Rube-Goldberg overengineered attempt at making the hockey puck meet the stick rather than the other way around.
Side-channeling "here's what our emails look like" kinda feels like kicking the info out a side door or something, which I can totally see internal clearances and perhaps legal just not liking the look of... and even if that approach did succeed, the less-straightforward internal handling associated with such an indirect strategy may well incur delays in updates and perhaps even occasional accidental article deletion (where the replacement articles wind up at different URLs and people have to take ages to find them... yep, Rube-Goldberg machine).
I can imagine a new broad scope in myaccount.google for "enhanced notifications" "if there is any suspicious activity with my account", with an associated stronger connection between account flagging events being classified in with suspicious activity in general.
Perhaps I'd first add other users' information under People & Sharing, allow them access to the relevant info in Data & privacy, then opt them in to security notifications in Security. (Where do I send my PM application again? ;) )
I'd probably want to be able to add direct SMS numbers (handled "magically" or "hands-off", like one-time verification codes etc, with the exception of being stored long-term) so that in worst-case situations if an entire group of accounts gets super-nuked or whatever (which presumably blacklists the contact methods associated with those accounts, including phone numbers - hence the idea of magical handling) I still receive last-resort notifications in case of edge-case mistakes. Obviously third-party email addresses would be ideal to add too (with the requisite amount of confirmation bustlework - I'm reminded of the absolute tantrum Gmail very appropriately pulls when you enable forwarding, maybe that would be too strong here but I imagine it might make for good inspiration). Adding Google accounts to send FCM push notifications to multiple stakeholders could also be a good idea (and, FWIW, may also create a helpful source of high-signal data to contribute to cross-account security analyses processes).
Generally I'm trying to cover 2-3 of broad bases here: that of having last-resort notifications still function in scenarios where the AI mistakenly decides everything about an account (or worse, set of accounts) is worst-case-scenario not-ham; making it possible to send those notifications to multiple users/contacts, including contacts that do not typically have access to a particular account; and making sure the notifications and pings actually get through even when the system really doesn't like someone.
Big scary banners on unrelated products is a great idea! I would never have thought of trying to vie for something like that, would have thought it would be possible.
Hmm, could you modify the user account avatar service so that if the user is requesting their own avatar they get served a giant exclamation instead? That could help serve as a perpetual reminder that would show up *everywhere* - Google homepage, account icons across the web and in random Android apps, etc etc. (Potential blocking issue: things might cache the avatar and get stuck.)
I've also occasionally seen how the homepage occasionally shows a very small infobox with a bit of text in it toward the lower quarter of the page. Perhaps this could be hijacked to prioritize showing the scary warning as well.
Totally understand that this'll move at "eventual consistency" pace :)
Feel free to copy the text of this and my parent (dumpster-fire...) comment into the feature request if that's helpful.
My motivation here is mostly a reaction to low-grade obsessive paranoia about AI glitching out on my or my family's accounts, and a strong interest in doing whatever I can to mitigate the fallout in the worst case scenario.
Thanks very much for replying!