As someone else pointed out, there is an unavoidable tradeoff that had to be made here between account security, accessibility, and privacy. Reasonable people can absolutely come to different conclusions, but I think it is arrogant to believe that a different decision from the one you would have made could only result from incompetence or ignorance.