cons: If the customers email service goes down, then their access goes down. If your email service goes down, then the service goes down for everyone. If a major email provider is compromised, then a bunch of your accounts can be compromised. All public server-to-server email communication takes place over port 25, unsecurred clear text. That seems like a poor choice for anything security related in 2017.

If anything we should be removing insecure protocols like email, telephone and SMS from the authentication chain rather than relying on them even more heavily than we already do.

I hate to suggest it but authentication via something like WhatsApp might be more secure.