I can't believe they act as they don't know what's going on and have no means to deter this. They SHOULD BE LIABLE!
Now I log in from a city in the Netherlands, 20 minutes later. From a phone, again, empty cookie jar. Even with a helicopter there's no way to make it there that fast. Should the login be denied?
(The answer is "no, because I've traveled to another city to visit a conference, and the conference network was routed in a weird way and the GeoIP data for their exit IP was incorrect".)
People jump locations all the time, for reasons like remote desktop sessions, mobile roaming, personal and company VPNs, etc.
Locking out a real user has a significant cost.
I permanently lost access to may aim account a while back because I tried to connect while traveling out of country.
The key, imo, is 'normal'. A new account has no activity, but an account that has, say, 3 years of only ever logging in from IPs located in, say, Detroit area suddenly has logins from Europe and attempts to change email/pass/etc while activity is still coming from Detroit - that's an anomaly. But until there's historical data to compare against, you can't really know. And... unless you've got a lot of computing power to check for that all the time (or outsource that sort of stuff), you probably can't detect that.