This reminds me of https://blogs.cornell.edu/info2040/2015/09/17/transmission-a... which was a lot of fun.

Would adding multiple payment methods to your google payments account mitigate the risk here?

The handshake contains the encrypted password. The idea is to reverse this encryption to obtain the plaintext password.