Because this would result in tens of millions of calls to the CS team to the general effect of "OMG someone is trying to hack my account!!! Do something!" to no purpose and decrease the adoption of a technology which materially increases per-user revenue and decreases per-user costs.