With a proper bank account, strong authentication with some dongle or code generator means if I have it, I can depend on being able to pay. No regard for the number of bots currently pestering them.
With PayPal trying to guess whether its me, maybe I can pay. Maybe I'll get a captcha loop. Maybe there will be a nondescript error message beginning with "Oops". Or maybe the error message will ask to call.. a rep that is not trained and/or authorized to do anything other than password resets. Which is not exactly a useful solution for account lockouts unrelated to the correctly entered, unique password.