You're trusting a whole lot of trust in the first place. But I imagine that they did not do that.

I can't sign into Apple Music on Android because it doesn't support security keys – small price to pay.