“The weakness Google fixed allowed attackers to bypass this validation process.”
Attackers created a few thousand Workspace accounts on domains they did not own by skipping email verification. Those accounts then used Sign in with Google to log into third-party services like Dropbox as the real domain holder. Google fixed it within 72 hours of finding it and says none of the accounts abused Google’s own services. Google’s services were fine. Everyone who trusted Google’s login was not.