The account asks who you are before it lets anything go
An unlocked laptop shouldn't be the same thing as your password. Turning off two-factor, changing the email on the account, exporting everything you've got, deleting a workspace, deleting the account itself — each of those now stops and asks you to confirm it's you. Being signed in is no longer enough on its own.
- It asks for the strongest thing your account actually has. If you use an authenticator app, it wants the six-digit code. If you sign in with a password, it wants the password. If you only ever sign in with Google, it emails you a code. You don't choose and you don't configure anything — it already knows.
- Turning two-factor off used to be a single click, which rather defeated the point of having it on. It now asks for the very code it's about to stop requiring.
- Confirming once covers the next five minutes, so changing your password and then your email doesn't mean doing it twice. After that it asks again, and closing the browser clears it immediately.
- Changing your password is the one place nothing new appears: the current password you're already typing is the check, so there's no second prompt for the same thing.