If you travel overseas a Yubikey (or equivalent) is apparently a good way of escaping the account lockouts that Google applies when it detects suspicious behaviour. While TOTPs and regular passwords can travel a continent in a few milliseconds, a hardware key cannot, so anyone using it overseas is much more likely to be you.

I've yet to test this but adding a hardware key is the advice I've found online around this particular issue.

(Yes, I also have my own domain in the case I get fully locked out, I am paranoid)