They were pretty much only ever used as a blocker for your email being spammed. As in there's very very few sites that would reset a password on a security question alone. The security questions purpose was just to avoid people triggering emails/resets to the wrong second factor. Despite the common belief they are worthless security questions they are perfectly fine when they don't reset the password directly and merely block users from mistakingly triggering a reset to a second factor on an incorrect account.

Do you know the common alternative to not using security questions in the above step? Doing absolutely nothing and allowing randoms to annoy you hitting your second factor with password resets. The ultimate place you rely on either way was the second factor and the questions were always better than nothing at all.