[pbhjpbhj]

I don't think it's that slight a difference - password reset is akin to a door that you have to break open. The reset is obvious, there's evidence.

A password-less login, the email can be deleted and unless there are logs of last login, and the user notes the pertinent detail, then the intrusion can be covert.

Having someone unknowingly have a key to your apartment is much more of a breech than discovering a broken lock that you know needs fixing.