> But it helps against account sharing

This is actually a feature, very common in real world, that security maximalists keep insisting is a bug.