Looks like the backup password can be reset too by support, so while that present an additional barrier to the attacker, it doesn't sound that effective.