I get the idea, but being pedantic if a system can be compromised using only externally discoverable information and no additional factors, I don’t think it was

I get the idea, but being pedantic if a system can be compromised using only externally discoverable information and no additional factors, I don’t think it was ever particularly secure. It’s really difficult to guarantee the secrecy of IRL factors. Privacy should be valued, but I think it’s hard to reason about any system that attempts to rely on it for security, so they shouldn’t be considered particularly secure.