The team that named the cluster was also caught by it, and published. That removes the easiest excuse for ignoring the technique.
A phone call, a consent screen, and a refresh token that outlives every password change. No exploit is involved at any step.