Perhaps I’ve missed some obvious reason why the industry still does this.
Because if you get a random email from some site you've never signed up for, there are two possible scenarios that you cannot distinguish between:
1) Somebody has maliciously signed you up to a legitimate site.
2) A malicious site is trying to get you to click a random link.
This proposal suffers from a common flaw, in which people assume they can change just one thing and have everything else in the world stay the same. Systems don't work like that.
Because if you get a random email from some site you've never signed up for, there are two possible scenarios that you cannot distinguish between:
1) Somebody has maliciously signed you up to a legitimate site. 2) A malicious site is trying to get you to click a random link.
This proposal suffers from a common flaw, in which people assume they can change just one thing and have everything else in the world stay the same. Systems don't work like that.