This seems to be primary an American thing. I have never experienced the usage of security questions with non-American companies. Even Apple uses it, which is weird considering they're so proud of their privacy-first strategy.