Doesn't this criticism apply to any service that allows password resets using email? I get what you're saying but if they already have access to the user's ema

Doesn't this criticism apply to any service that allows password resets using email? I get what you're saying but if they already have access to the user's email inbox then I consider the user popped and I'm not afraid of them being further compromised by some cute correlation attack because the attacker also now knows where they rent a kayak from. If anything it reduces their risk because now if my db got compromised there's no password hash to crack.