My mom and stepdad use a piece of paper for their passwords. Old passwords are crossed out, and it sorta works as a "secure" password manager. Like most people

My mom and stepdad use a piece of paper for their passwords. Old passwords are crossed out, and it sorta works as a "secure" password manager. Like most people, they still occasionally forget what a password is for a give site/app. At that point they proceed to the password reset flow and (hopefully) cross out the old password and write down the new one (accurately). Most password reset flows use email. Aside from state sponsored efforts, password reset flows are "downgraded" to using a user's email address: > Click here to recover your login ID. (user gets email with a link or text with the "username") > Click here to reset your password. (user gets email with a link to reset password) If the site provides a level of 2FA or hint: > Enter your 2FA token from your authentication app, or... > Enter your mother's maiden name. Once 2FA is confirmed, or doesn't exist, the password flow continues: > Type in a password (various requirements for a password ensue) > Login again with the recovered "username" and password. (user tries to login again) Struggle with saving new password to various password managers ensues. > Login is successful, or not. If password flows are "secured" with emailed links, why not just make "logins" use emailed links, with some one-time token that just logs them in? This would make any login to a site/app as "secure" as the user's email login: > Type in email address (user is sent a one-time login token to click or enter) > Type in the one-time token (user is logged in if the token is correct) If the token is wrong, reset the token and take no action. Also, logging the user out on a shorter interval gets them comfortable with this regular "login" process. A more speedy login can be achieved by collecting the user's phone number. If the phone number is successfully collected, logins can proceed: > Type in email address (user's phone is sent a short code) > Type in the code sent to the phone (if it's wrong, reset it and tell the user to try again) > Add 2FA on top of this to secure SMS security deficiencies This simplified "reset password" flow is then presented as an alternate solution to logging in without passwords, to a given app or site. What am I missing here?