Asking authentication service to not use risk while using phishable authentication methods is essentially asking them to not bother with any protection from phishing and various password and 2nd factor theft.

If you don't like risk-based auth, use non-phishable authentication method like security keys.

Note that false negative (letting attacker steal) is roughly equivalent as false positive (not letting actual owner access the account) from the owner's access since the owner can't access the account in both cases (most attackers try to take over the account and lock out the original user - if you are a target of sophisticated attackers who would silently steal and watch your information, you wouldn't complain about risk based protection). But the former is worse from privacy obviously, thus any sane provider tend to choose false positive over false negative. The only way out of this bind is to use non-phishable auth, and at this point, security key is about the only one, with app based notification being close.