> it provides the same level of security No, it absolutely doesn't. If an attacker breaches a user's mailbox, and then uses a 'forgotten password' process to

> it provides the same level of security No, it absolutely doesn't. If an attacker breaches a user's mailbox, and then uses a 'forgotten password' process to gain access to another system, the user will know about it - their existing long-lived session would be killed, and the password they remember/have saved will no longer work. If the attacker simply uses the mailbox access to use & delete "login link" emails, they could make use of this to access the victims account for as long as they have access to the mailbox.