Why might code that reads Authentication.getPrincipal() break for a user who logs in via Google instead of a normal username/password form?

Username/password login populates a UserDetails principal, while oauth2Login() populates a different type — OAuth2User (or OidcUser for OIDC providers like Google). Code that assumes the principal is always castable to UserDetails will throw a ClassCastException the first time it runs for a socially-authenticated user; applications supporting both login methods need to handle both principal types explicitly.