If logging in disabled all checks, all bots would just spam-create users first. Of course it needs to run for all users, without it being necessarily nefarious.