You're absolutely right. I currently develop twonly, an open-source alternative to Snapchat, where I encountered exactly these kinds of problems, such as a passwordless recovery. I came up with the following solution, happy to hear feedback :)

https://twonly.eu/en/blog/2026-passwordless-backup.html