Option 3: companies that you pay to provide authentication service. Regulated so that they clearly tell you if they are subsidizing service outside of your payments.

Then you just need to hack this company instead of Discord, you only change target.