Comment by dpoloncsak

I think they're saying Users with alternative sign in methods are unaffected, but users without another sign in method are locked out.

Otherwise, how do you verify the user is requesting the one-time sign in and not a threat actor trying to associate the account to their own email?