I think that's it. They might consider three use cases: 1. normal usage multiple times a day, 2. grandma using it once a month, but always from the same device

I think that's it. They might consider three use cases: 1. normal usage multiple times a day, 2. grandma using it once a month, but always from the same device at the same location, 3. people using as an anonymous/burner account (likely from a clean/incognito browser session, maybe using a VPN, without phone number on file, etc.) With the current implementation, 1 and 2 still mostly works, and they don't care that they make it impossible/inconvenient for 3.