Google verifies your identity (incl. MFA); the app then checks you against its allowlist. Nothing else is reachable without it.