If they didn’t want to use passwords to avoid support calls, they could have sent one-time login codes to the phone number or email address associated with the account. Or literally anything other than neglecting security altogether.