It’s not as bad if you control the domain as you could always setup a new provider. Note that I didn’t say “own” as the risk of the domain being seized will always be present.
All in all, it’s no different than delegating to your email provider to prove your identity via a password reset / login link.
All in all, it’s no different than delegating to your email provider to prove your identity via a password reset / login link.