Collecting credentials and reading mail from server is standard practice across hosts of email clients,

In some countries this is "unauthorised access to computing systems".

But Google and co. are above the law anyway.