This is not true for Google at least. I have been locked out of a secondary google account because they thought it was suspicious that I logged in from a new IP

This is not true for Google at least. I have been locked out of a secondary google account because they thought it was suspicious that I logged in from a new IP address after 6 months of disuse. I have the password, I have the TOTP codes, I have the recovery email (in fact I even have the email for that account, as it forwards to my primary account), but login is just not allowed until I accept a push notification on a destroyed device. For some reason, my primary account was not subject to the same probablistic lockout, maybe because it had a more constant record of use, or maybe because it was a GApps account.