If many were to change to email based auth the chances of any leaked (accidentally sent, tricked into forwarding etc) email containing sensitive info would go u

If many were to change to email based auth the chances of any leaked (accidentally sent, tricked into forwarding etc) email containing sensitive info would go up significantly. E.g. any mail from medium.com has a very high probability of containing login info. Second, increased roi makes mail servers more of a target.