Eh, I agree.

I have root access to the server and can directly interact with the backend DB. Forcing email for a password reset doesn’t protect me from me.