They’re noting that at the end of the day you are relying on access to email as an authenticator. If you can use just an email address to recover access to an

They’re noting that at the end of the day you are relying on access to email as an authenticator. If you can use just an email address to recover access to an account, the security properties are effectively the same as just sending a magic link email. Of course for anything important, you shouldn’t allow users to recover access with only a link in an email. Personally, I like it when a service requires that you pass an MFA challenge to reset your password.