Part of it is about avoiding the possibility of screwing up by eg picking poor passwords or giving your password to the wrong site or allowing replay attacks (t

Part of it is about avoiding the possibility of screwing up by eg picking poor passwords or giving your password to the wrong site or allowing replay attacks (though I guess tls mostly protects from that). You don’t need to rely on cloud backups, though many users will. It is also usually possible to set up things like account recovery codes (which you print out and put somewhere safe) or TOTP auth (more useful if you eg aren’t able to carry a yubikey everywhere with you / can’t plug it into your phone).