u/mootinator

Aside from red flags all over the actual message it looked legit.
The specific red flags in the message being:

1. You've successfully approved a request to add a recovery contact to your Google Account. (Doesn't match the subject)
2. If you didn't request this person to be your recovery contact, check your activity and secure your account below: (Standard phishing "if this wasn't you" call to action)

There was, of course no new "security activity" on my account.