I use Outlook for one of my e-mail accounts. Now every time I want to sign in to that account, I have to provide the related e-mail account formerly used for password recovery, and a unique 6 number code is sent to the secondary account, which is needed to sign in the the outlook account.
I'm given the option of 'remaining signed-in', which, if chosen, would eliminate this verification step.
Remaining signed in to online accounts allows for more efficient data mining of one's internet activities. Ideally, Microsoft, Google, Meta, etc. would want everyone to stay signed in to e-mail accounts, facebook, Twitter/X, etc. ; 'all the better to track you with, my dear'. These companies also want you to sign in with a mobile phone number, which easily allows them to match your 'anonymous' online handle(s) with your phone number, allowing for 'persons of interest' to have their current and recent geographic locations to be monitored through Google Earth.
Most people will just give that information up, for the sake of convenience. Just whom may have or may be able to obtain that kind of information is anyone's guess.