“Other examples include PayPal, where you can literally enter a credit card number to prove your identity and reset your password(!).”
Sites now demand an emailed code on every login, which is the password reset flow wearing a login page costume. They distrust a 24-character random password from a password safe and then happily accept a single API key for the same account. AWS runs its highest-stakes services on exactly that kind of key. The industry already agrees passwords should be random, so the site can generate one and stop pretending users need to be trusted with it.