The point about zero-click flew over your head. After inputting your email address and clicking verify or whatever, your browser is meant to ask you for consent to check your inbox first. You can find that detail in the full API proposal. The video demo does not do this, which is why I claimed Google would probably omit this step and make the consent implicit :)

However, at that point, the website can in fact check if you're logged in to a specific email address automatically. There is no need for user input. This can be abused by websites to link your identity, for example, if they suspect you are using two different email addresses for two different accounts.

Also, there is a huge difference between the browser displaying your email inbox and the browser having autonomy over it in the background with no user interaction.