Sure, but as long as the fallback for account recovery is sending a reset email or sms (both of which are similar or worse than yoloing textfiles on dropboxes), that's a very tough argument to make in good faith.

I agree that account recovery isn't the best. But just because that sucks doesn't mean there's zero value in improving credentials.