My concern is that an app could be spoofing this whole screen to steal my credentials. Is 2FA/MFA good protection in this case? Is there any way to tell if this screen is not spoofed?
It's called phishing, and no, 2FA doesn't prevent it in most cases (but you should still use 2FA). This sort of attack is why people recommend to always look at the browser's address bar before typing in a password (though that's had its own issues). When logging in through a local application though, you just have to trust that application to not steal your password. If you don't trust it, don't run it.
The only type of 2FA I'm aware of that can prevent this sort of attack is Webauthn and U2F, but this is only applicable when logging in through a trusted web browser. With a local application, all bets are off.
You are absolutely correct that this is a security concern.
RFC 6749 - The OAuth 2.0 Authorization Framework (which this "login with Google" system is) describes this problem in section 9:
An embedded user-agent poses a security challenge because resource owners are authenticating in an unidentified window without access to the visual protections found in most external user-agents. An embedded user-agent educates end-users to trust unidentified requests for authentication (making phishing attacks easier to execute).
So the correct way from a developer's perspective would be to use the user's browser directly (and not embedding it). There are also some more benefits, also explained in section 9.
Unfortunately, this doesn't always happen in practice and for most users it is impossible to detect a well-made phishing screen here, as the developer of the native app (in this case: Postman) could simply proxy the real login screen through while storing the authentication cookie. Not even 2FA would help in that case.
You should evaluate if you trust the developer of that application enough or ideally ask them to fix their login method.
A fake login screen is the first major social engineering attempts made long ago when the web was young and it still persists as an effective route to gaining people's credentials. That's what phishing is, to a large extent.
So, yes, 2FA/MFA is the response to this threat and is a big reason why 2FA/MFA exists. Always enable 2FA when you can.
You would have to look at the code and what the source was of the login screen to determine if it was legitimate, if the screen was not obviously faked (which is difficult to do).