All because of advertising. Strong passwords + not tying the account to an email address is the most phishing resistant thing one can do, however nobody is allowed to do this because they need your email address for advertising. Stop welding my identity to an email address and the entire problem becomes an order of magnitude easier to manage and maintain.