If you use an identity provider like Okta or OneLogin, then you're not tied to any "contentful" services like GitHub or a Google account that "historically" seem to have more problems of this type.
As far as threat models go, I can't really say I understand this one too much.
As far as threat models go, I can't really say I understand this one too much.