[aramsh]

What's even more interesting is there is no DNS records for important.g.co, which means they have found a way to create an Google Workspace without verifying the domain but still able to send emails like password resets.

It's definitely a glitch where you can send emails/transactional emails from an unverified Google Workspace. My guess is that their are protections for google.com and google domains but they forgot to add the g.co domain, which allows unverified sending to g.co and creation of workspaces.