You could also remove that customer pain point by auto-verifying them without checking their email for the very first time they login, and it would expire after

You could also remove that customer pain point by auto-verifying them without checking their email for the very first time they login, and it would expire after they close their browser or 1 hour, whatever comes first. It's really no less secure than allowing someone to sign up with an email / password and let them in without first confirming their email address.