Once the browser has discovered the issuer and knows that the user is logged in to the issuer, it is pretty confident that can provide an EVT, so it can choose to ask the user for permission. Each browser implementation is responsible for making their own judgement based on their user’s expectations, so this specification isn’t opinionated about how the interface with the user materializes.

Google has likely chosen to make the permission prompt a one-time thing, which seems fine to me.

However, at that point, the website can in fact check if you’re logged in to a specific email address automatically.

It cannot.