It's not necessarily that companies are ridiculously lax; it's that lost / forgotten passwords happen at a rate millions of times hacking attempts. You can do

It's not necessarily that companies are ridiculously lax; it's that lost / forgotten passwords happen at a rate millions of times hacking attempts. You can do things like require government id to recover a password which will probably go a long way towards insulating you against hacking attempts, but it will piss off millions of people who lost a password and want to be able to get a new one in 30 seconds or less.