This is true for drive/calendar as well. Good you can use 2FA for login, but very bad it is stay open indefinitely. A kind of auto logout after an idle time is crucial for decent security.