If I wanted to, I could create a fake SMTP server script with netcat to answer all of the SMTP responses from Google.

So why leave the existing "send email as" addresses that are grandfathered in?

I have had many accounts which I don't have direct SMTP access but which I can read those emails (various aliases, forwarding accounts, Mozilla email relay, SimpleLogin aliases, Duckduckgo account).

I get that they have to protect their DKIM/SPF reputation.

Am I missing something in their UI?