> It's my account that's at risk of hijacking, so I should be able to decide. If I opted for no 2FA despite Google begging me to turn it on every login, that's my decision.

If that is your argument then it is their service. They can decide how to offer it. Services like this are designed for majority - and a majority are happy. If you don't prefer then you can find alternate services. Market is wide open.