The problem is that they can’t tell who is who, nobody wants the extra hassle of extra security, and in the end the companies have to deal with the fallout (customers asking for account recovery, compromised accounts being abused, …).