It's about risk management. In this case they decided to take on the risk of account information leaking by not verifying the address instead of the risk to account conversions. The former shows more care toward their users and the latter shows more care to their bottom line. You can argue which is the right decision all day long but ultimately is a question of risk tolerance.