I think the company eventually required verification, not because their trusted employee told them, but because a security review of the product pointed out the lack of email verification.
When it’s just a random staff member complaining they want to do something that makes it harder to onboard customers, there’s no proof of incompetence, and incompetence can still be blamed on the developers.
Also keep in mind that the company has full access to your work email account therefore they could delete the email if they wanted to. Not likely they would in general but people have been known to do all sorts of things in situations where a written record could hurt them.
What about for the purpose of improving the product you're (assumingly) full-time employed on?
Telling that that wasn't one of your hypothetical reasons :)
Therefore the main purpose of writing the initial suggestion down is so there's a record of it for future use. Either to cover your own ass when management/auditors/lawyers get involved, or to say you were right and management was wrong and make yourself feel superior.