If the registration email is compromised, the attacker can reset the password. So the password doesn’t offer any additional security, in actual practice, over just testing control of the registration email address.