There are lots of interesting statistics from Google on the effectiveness of basic security measures in this post
The result that struck me the most is the following:
Sending a SMS with a code, IF AND ONLY IF Google’s systems believe that a log-in attempt is suspicious, blocks 100% of automated bots, 96% of bulk phishing attacks and even 76% of targeted attacks
https://security.googleblog.com/2019/05/new-research-how-effective-is-basic.html