It is so difficult to explore anything that Google announces without passing it thought the lens shaded by their ad business model. It doesn’t matter with what intention they implement a change or if those intentions are pure.
Sure, this will make the login secure by preventing credential stuffing. But doesn’t this also help them get more data from users who preferred not to by disabling JS? And was this the best and only solution to tackle this problem?
I believe internally too, Google must struggle with this perception.