Its perfectly acceptable for a security model to make things difficult for extreme edge cases like the pope. After all if the situation warrants it such rare events can always be escalated.
To frame it another way: Better to inconvenience the pope once every few years than have tens of thousands of "little person" account compromises every year.
I expect his Holiness might agree.