Two-factor authentication

Channel access runs through the Google account that owns it, so 2FA on that account is what protects the channel. A code from an authenticator app, a passkey or a physical security key is asked for after the password, and an attacker holding only the password gets nowhere. SMS codes count as 2FA and they are the weakest version, since a SIM swap defeats them. Channel takeovers usually start with a fake sponsorship email carrying malware that steals session cookies, and stolen cookies can walk straight past 2FA, so it sits alongside caution about attachments rather than replacing it. Google's Advanced Protection Program hardens the account further.