How is setting up a catch-all more secure in terms of account takeover? All the emails still go to one mailbox.

The only benefit is that when a website decides to sell your data or leak it, you know who is to blame and you can block that one e-mail they send the spam to.