I'll do one drastic, but not unthinkable, example. The Signal messenger source is on GitHub. You can't imagine a single oppressive government out there that would be keenly interested knowing who in their country is interacting with it? Or maybe you haven't noticed that there are a lot of countries not too keen on encryption, trying to backdoor everything or just straight-up outlaw encryption. This isn't just about a single login box. "Who's looking at what" is the kind of surveillance that blacklists thrive on.

And please don't come back with "then use a fake email". Once you're that far gone, you're definitely breaking a user's "core experience".