Companies have to invest in tech before you can pull the plug on resets
MFA, across the board, on all services, is a must.
Otherwise accounts are at a major risk of compromise since people tend to use the same password across systems and services, which are eventually hacked.