I have an old Google account that got hacked, but Google's login protections are super paranoid about it.

I just had the weirdest login flow ever.

1. Laptop shows a QR code to scan on my phone
2. Phone opens to the Google login screen and has a button to compose a SMS
3. The button switches to Messages app to send a message that says "Send this message without editing. (<random code here>)".
4. After sending the SMS, the mobile login screen says to continue back on my laptop
5. Laptop continues the login flow. (It then locked me out because Google don't like me and have now 'deleted' the account)

What sort of threat model are the possibly looking at where phone number ownership by OTP isn't enough, they need to _recieve_ a message from my number?

Are they worrying about phone malware or other interception?