twest @Adam
Whilst most of the things you described are true here, the issue arises when you have a huge web hosting company with thousands of users.
At some point, you should expect that some of the users are not there for the service (especially if you offer free/discounted services) and may attempt to compromise/attack your system for financial gain.
Imagine an attacker gains access to one customer's Enhance account, either through social engineering or a weak password. Since profile management is non-atomic, the attacker can change the email address to one they control. Now, they can receive password resets, manage the websites or see notifications meant for the legitimate user.
Additionally, imagine you have thousands of users and they all started mixing up emails. A non-atomic system can't be good no matter how you put it, especially when tons of custom integrations may depend on the accounts being consistent and in sync.
Your response clearly shows that you've never dealt with active clients. Are you aware that things that may seem obvious to you are not to them?
If billing handles authentication, profile management, there's even no need to have a password authentication feature, as well as password resets at all because logins are always SSO. What's the point of implementing SSO if you can't even disable normal logins?
Principle of least privilege, please!
