They're definitely on the theater side of security. I've got locked out of my account multiple times for no reason.

Furious the second time, I sent a crafted image of an invalid ID to check if they actually even care. It seems they don't, as the account got unlocked all the same.