> if phishing attacks were more common and more damaging than lockout

The calculus changes if the service is a bank or your stock broker, which, if you are in any reasonable jurisdiction, if you can prove your identity (in court) they are legally obliged to ensure they give you back your money.

But, for the vast majority of other internet services... I honestly don't think anyone would want to MITM my instagram account for example.