This issue only affects apps though. When granting OAuth permission via the web, you are actually redirected to google's website, and then afterwards redirected back to the site you were on.
https://developers.google.com/identity/protocols/OAuth2Insta...
Which probably isn't very helpful, as lots of users won't notice whether they are using a browser or not.
Does anybody know how Pokemon Go ends up interacting with accounts that have 2 factor authentication turned on? I sure wouldn't type my main password into some app, I'd at least use an app password: