It's true that every service has to deal with the same policy and lockout problems, but that doesn't lead to the conclusion that the risk is the same. I pay for FastMail because 1. if something goes wrong, I can reach a human without needing to write a viral blog post first. Other services pay for a customer service department. 2. I trust FastMail more to not shut down their product because they got bored. Sure Gmail…
"I can reach a human" is a huge security vuln. I don't want people social engineering my identity provider.
I would contend that if you cannot reach a person, you cannot trust a system. And that has generally held in the entire history I've been on the Internet. I chose my web hosting by who had phone support, I've had the CEO of Fastmail respond to my support tickets before. I have yet to be betrayed or compromised by a single platform where humans were involved, but automated systems have failed me regularly.
This is true of offline systems as well. If you want a security system to protect your business, you may have keypads and sensors and things, but you also have a monitoring center staffed by people who can see events in real time.
I think our industry has had a fantasy that complex enough math problems can provide real security, but I would hope by now the cryptocurrency market would've put that silliness to bed by now.