AFAIK It's nothing to do with "punishing" non-iPhone users, it's a way of reducing account break ins. Signing in from a physical apple device gives them more in

AFAIK It's nothing to do with "punishing" non-iPhone users, it's a way of reducing account break ins. Signing in from a physical apple device gives them more information about the sign in itself - signing in from a browser gives them nothing that's useful. So if you can't sign in to the App Store, and it can't send a reset code to your Mac that means your Mac isn't signed in to iCloud (the OS level sign in to iCloud services, not the App Store sign in with an Apple ID) - so why couldn't you just do the "reset on sign in" in step 6, on your Mac?