Interesting write up and 2FA by default sounds like a sensible move.
If you’re the type of user to have a DO account, you should be perfectly capable of using 2FA.
A number of accounts would have been accessed were it not for 2FA.
The best password won’t save you if a reset email is intercepted.
Something you have plus something you know should be what we cone to expect from any service that deals with anything of importance.
If both the email and DO account are behind strong, unique passwords, that won’t happen from a mere DO email leak.
Now, if the same, weak passwords are used for both accounts, sure. That’s terrible practice. But it’s also not what the GP was talking about.
That's not something fundamental to passwords. It's just that the culture of security in the industry seems to be more willing to lock people out of their account when they lose the factor they have than when they lose the factor they know.
It could be that losing what you have is easier for people to remedy than a forgotten password, but somehow I suspect that it probably comes down to which one generates the fewest angry customers/calls/support tickets. Maybe it's easier for us to blame ourselves if we forget to carry a token or our cell phone?