Earlier quoted context omitted.
I lost access to a PayPal account I had used for years, because one day they decided they needed to know the CVV of a long-expired credit card, and refused to let me log in without it. Surprisingly, customer support was very helpful and let me transfer out the (minimal) balance in the account to another, completely unconnected PayPal business account I happened to have. Which is even more disconcerting, because it me…
Transferring money out is far lower risk than unauthorised account access. If they transfer money out and it turns out it was fraud they can easily compensate the original account holder by putting the money back in their account and there's little harm done, especially if the sums are small. If they give unauthorised account access then there's far greater harm including risk they'll get penalised by regulators over…
After many years, there may not be a force to assure these processes are consistent, have rules that make sense in relation to one a other. I think the answer may just be it’s “dumb” because no one cares or has the power or will to look at things holistically.