Is it though? Just because a password leaked doesn’t mean it will actually be abused. A homeless person without a credit card in their Google account is naturally limited in the amount of damage that can be done.

Security questions are probably enough, at least for people who can’t handle 2FA.