This checklist was designed for corporate-to-corporate and corporate-to-military sites which host data deemed valuable. If you are designing consumer websites where the user data is not particularly sensitive, then this advice is not appropriate.

In my applications, it was the customers who demanded that account recovery flows be removed, which I imagine is far from your own experience.

I will make a note about the intended customer group in the page . . .