Netflix should validate the email account. But, also, when you get the email to update the invalid credit card information and you click on the link, shouldn't

Netflix should validate the email account. But, also, when you get the email to update the invalid credit card information and you click on the link, shouldn't Netflix force you to Sign In? This kind of security step is already common to thwart attack vectors where someone finds your computer unlocked and tries to reset your password on you. Google does this when you go to accounts.google.com. They always verify it is you sitting in front of the computer. So getting back to the Netflix situation, once you click on the link to update your credit care info you won't know the password for the rogue account and it's not your account UUID or whatever so I'm assuming Netflix is smart enough to make you prove it's you by entering the password. But you won't know the password. If you were tempted to click Forgot Password and go through all that rigamarole, then you hijacked the attacker's account. I guess what I'm trying to say is, most of the issue here should already be solved by appropriate defenses against different types of attacks. No?