Google Account without Google email that routes email to a Google Workspace address

My son has an email address of the form tim@familyname.com where familyname.com is a pseudonym for a domain I own with legacy free Google Apps (now Workspace) accounts.

He also has a Google Account with the Google Account ID of tim@familyname.com. I think he created it somehow with YouTube. (He has a cognitive disability which doesn't stop him from doing some weird shit I can't figure out.)

His second Google Account does not have the email address of tim@familyname.com because that belongs to the Google Workspace account. Instead of it has an email of the form: tim%familyname.com@gtempaccount.com. If I send email to that gtempaccount.com address it redirects to tim@familyname.com.

This feels like a security risk waiting to be exploited. It certainly is weird. It reminds me that Google Workspace accounts don't have the same meaning and privileges as full Google @gmail.com accounts.