U2F is the fix for this.
What's happening here is that Google accounts without 2-factor but with a phone recovery path set up are being "account recovered" by a bad guy. It's just plain old phishing.
A 2 factor recovery flow would be 1) verify an email that was sent to your recovery email address that triggers 2) this account recovery code sent to your phone.
While I'd have thought entering your email password would have been red flag galore, my mom and her friends were all exploited by the social trust aspect "I figured if it was coming from you it would be real."
You should set up a strict DMARC policy (p=reject) to prevent people from spoofing your email address. It appears that you have not[1].
Additionally, you should harden your SPF record: change ~all to -all.
It also was my mom that was phished, not me.
I subsequently set them up with two factor almost everywhere, but I'd give at least even odds they'd fall for this, too. Sigh.
Since the security key works with the browser to ensure its communicating directly with a specific site, you can't MITM them like you can mobile app (TOTP) or SMS-based two-factor codes.
I wish more browsers would add support for them.
Even if an attacker gets the phone code, they should still need your password to sign in. How do they get past that?