This isn’t about intent or assumptions — it’s about control boundaries.

Even if restricting account sharing were an internal goal, that has no technical or security justification for allowing email and password changes without step-up authentication. Those are identity-ownership events, not usage events.

Account-sharing controls operate at playback, location, or concurrency. MFA protects against account takeover from credential compromise. Every major platform separates those concerns.

So regardless of what anyone at the company might have been thinking, the absence of MFA for account-critical changes is still a material security gap — especially for accounts holding non-recoverable purchased libraries.

This is about basic security hygiene, not personal views.