> There are security teams inside those megacorps that have a general objective of reducing the number of account takeovers

Said security teams have at most zero incentive that the privacy of the policy subjects is preserved.