Google would probably justify this as security, and not necessarily unreasonably, but it has a clear anti-competitive effect too. The security concerns would be more credible if they made it easy to debug this, like giving a useful error message back to the sender stating what the missing security criteria are and having a clear process for appeals (like if you got unlucky with an IP address, or if you are missing a specific security measure on your domain).
