A lot of companies have started doing this because a compromised account can be used to attack the service (logged in sessions avoid rate limits) or other users

A lot of companies have started doing this because a compromised account can be used to attack the service (logged in sessions avoid rate limits) or other users (spam). They aren't necessarily trying to protect you.