The problem with security is if they make something like recovering a password too hard then they have to deal with all the idiots that can’t remember secret questions/their own information/etc. But if they make it too easy then people with actual intelligence complain that it’s not secure. Unfortunately there are far more stupid people in this world then smart, and because of this large companies accommodate them.