I agree with everything except the browser login bit. It should give you the option. I uninstall any app that provides me an electron rendered window claiming to be Google but with no visible URL or TLS info. It's a bad bad idea to let average users get used to the idea that they should put their google password and OTP into a black box that can do anything with it.