In simple words, you are in charge of the security of your account.

If someone creates a VSC account via email and their email gets compromised, can the hacker get access to the VSC account? My logic says yes, which means not all login methods are equally secure. It's of course why you said what you said above, but will potential Web 2 users be aware of the potential risk, since it's one thing to lose access to your secondary email and another to lose access to your money?