I wonder if they're calculus here is that its more likely a laptop/desktop login is shared than phone access (which will require a gesture, passcode, or specific face). SMS can get real personal much faster than email (can use temp emails for those questionable logins but you tend to have one personal number)
Or its actually a bug, lol