I think you should focus on what an attacker gains by your app leaking account existence. Is that knowledge valuable or revealing? If not, then probably not nec

I think you should focus on what an attacker gains by your app leaking account existence. Is that knowledge valuable or revealing? If not, then probably not necessary to overcomplicate it. E.g. in the Shopify case, you learn that an email address has a Shopify account. That should be fine as long as they have some rate-limiting in place on their auth endpoint and enforce good passwords. YMMV, I'm not a security expert, etc.