I agree, access to other accounts is of greater threat.
When I created this account, I wanted to build upon the premise of privacy of proton mail & so I created using VPN, with no personal link whatsoever (hence no recovery email).
Unfortunately when my decryption password failed, I had no means of recovery until I attempted to talk through support successfully.
For most people the big risk is that their email can be leveraged to gain access to banks, social media etc through password resets.