The fact that netflix lets you create an account without verifying you actually own the email address they are sending the token to is the real bug. Besides, e

The fact that netflix lets you create an account without verifying you actually own the email address they are sending the token to is the real bug. Besides, even without a magic link, they could still phish you into clicking a link to a malicious page that performed a login-csrf which would have the same effect.