The thing that keeps me up at night is what’ll happen to the email for my custom domain. If the domain registration lapses, anyone can snag it and do a catch all for my email addresses. Then, they’d just need to do a password reset to get into my accounts (assuming there’s no non-email based 2FA).