They don't know what they are doing if they have those questions. I've found mine in multiple data breaches. If they were real they'd broadly grant access to every account.

Or maybe to be more accurate: they do know what they're doing, recovery is a cost center so they're minimizing it. But outside of special cases with special statutory affordance (like credit card fraud) the loss is on you* if you get robbed via their weak security. So companies are intentionally minimizing their costs because you're the one that takes the cost when their security is poor.

I have encounter the pronounceable issue-- though reading 32 hex characters over the phone really wasn't *that* bad. So now-- and for the last 15 years-- I make them pronounceable passwords.

> especially in a crisis time

I've tried to organize my life so that I never need 'crisis' access to some stupid online account. I recommend it!