The thing that confuses me here is why these sites would 'merge' accounts if you sign it with another identity provider after supposedly having signed up with t

The thing that confuses me here is why these sites would 'merge' accounts if you sign it with another identity provider after supposedly having signed up with that email address separately. Shouldn't it just create another account? Or maybe say that the email associated with the account has already been used on this site, and to reset your password instead? Feels like the issue stems from these sites opening a huge security hole in their sign up process in exchange for the tiniest piece of convenience that most people will never encounter or need.