Magic links and federated emails have the same points of failure. If you got their email password you're in

And I don't like federated emails because I can't tell Google (I can tell FB, ironically) that I don't want all my data shared with the service I'm logging in with (some services like Samsung phone stuff wants to get everything)

So thanks but I'd rather only share an email/password in some cases