Which Google API do you mean? I use advanced protection and have developed various things with various Google APIs, I just use a service account with minimal privileges for each thing I'm developing, which is probably best practice anyway. Not sure about rclone but probably it would work fine with a service account too?

It blocks any unverified OAuth app, including the ones you create yourself.

It sounds like you're trying to use APIs with your personal account rather than using a service account though? Again, I use Advanced Protection and I've never encountered the problem you're describing.

I'd just use a dummy account for developing.