> Are homeless people's email accounts getting hacked three times per year?
The aversion to 2FA makes them seem like easy targets if I'm looking for addresses to use for spam.
> maybe getting hacked is worse, or maybe loosing access is worse, but the user should have the right to make that decision
Getting hacked makes losing access considerably more likely. This ain't one or the other.