Most people simply don’t get the point. They don’t understand, let alone care about, digital privacy and security.
Anecdotal evidence: I have a short Gmail address (think [email protected]), and a lot of smartasses use it to subscribe to everything, mostly as a throwaway but also on e-commerce sites, fintech bullshit with access to their bank accounts, …
Once I got curious and reset the password, logged in and the moron had already filled in all his personal info, including his credit card. Another time I sent an SMS to the guy asking him to stop, he replied “it’s my address, my nephew set it up for me, I guess we just have the same one”.
These guys would never take 10 minutes to set up a 2FA app.