It's to outsource the security risk/liability to a third-party

I mean if your email is compromised, most of your accounts can have their passwords reset, no? So it’s basically the same as resetting your password every time you log in. Dumb, I agree, but surely not worse from a security standpoint, right?

Fully agree, it's almost security theater.

They need to offer a way for use with a password manager, maybe a slightly hidden option or detecting a really long password to stop all the extra bits.

I forgot what the service was but it will have my user and pass, prompt the email verify, and then it will ask for the token generated in an Auth app.

At a certain point the proper user probably can't get in

To be fair basically all services allow resetting passwords via email so even without the magic email link they'd be fucked anyways if their email got hacked.