I guess to reduce friction for signing in Most apps are not significant enough that people will go through the pain of checking their emails to get the new tem

I guess to reduce friction for signing in Most apps are not significant enough that people will go through the pain of checking their emails to get the new temporary password Also , a lot of email clients still use STARTTLS while communicating with mail servers to fetch emails , which means a MiTM can reduce that connection to plain text (isp’s have been caught doing this before to read people’s emails) and then steal your password. A site that enforces a rule like that must guarantee that its user’s email server only allows TLS only handshakes on client side (which is difficult if not impossible to do 100% of the time) So even if the idea is great , due to the state email is in , it’s pretty risky and unsafe to MiTM attacks and network inspection.