Yes. Also google/facebook can impersonate you here, without you knowing. You could do multi factor account recovery via nip05 if you really wanted to. But that opens up some trade-offs.