The key part there is that in such an environment it is obvious for any company (and their customers) that "something your spouse or mom would know" is not an a

The key part there is that in such an environment it is obvious for any company (and their customers) that "something your spouse or mom would know" is not an acceptable security measure for anything, so it does not get used. But it does not have to be a tradeoff, we could easily have companies avoid such security questions even if privacy is still mostly a thing we get.