An account can be protected by a long password and a hardware key and still be taken over. Attackers frequently ignore the login entirely and target the process that restores access when credentials are lost.
Recovery must accept weaker evidence
By definition, a locked-out user cannot present the credential the system normally requires, so recovery accepts substitutes.
Those substitutes are typically an email address, a phone number or answers to preset questions, each weaker than the credential being replaced.
The security of the account therefore drops to the strength of whichever recovery path is easiest to satisfy, not the hardest.
Email is usually the root of the tree
Most services send reset links to a registered address, which makes the email account a master key to everything registered with it.
An attacker who controls that mailbox can reset a long list of accounts in sequence, without ever attacking those services directly.
This is why the email account itself warrants the strongest available protection, since it sits above the accounts it can reset.
Phone numbers are transferable
Codes sent by text depend on the number reaching the right handset, and numbers can be moved between carriers and devices through account processes.
Those processes are operated by carrier staff following identity procedures, which introduces a human step outside the service's control.
Numbers are also recycled after abandonment, so an old number left on an account can end up belonging to someone else entirely.
Security questions are public information
Questions asking for a birthplace, a school or a mother's maiden name request facts that are frequently discoverable or already exposed in past breaches.
They also demand exact string matching, which pushes users toward memorable and therefore guessable answers.
Where such questions cannot be avoided, treating the answer as another random secret stored in a password manager removes the guessability problem.
Support channels are part of the attack surface
When automated recovery fails, a human agent decides, and that decision is made under pressure from a caller presenting a plausible story.
Social engineering targets exactly this point, supplying details gathered elsewhere to satisfy verification steps designed for genuine customers.
Services counter with callback procedures, waiting periods and notifications of recovery attempts, all of which trade convenience for the time an owner needs to object.