Password recovery & some information is sent out to that email, so the npub would need to trigger DMs or something like that

Also you would need a way to verify the npub belongs to you, without increasing risk of key loss

Could it perhaps help avoid phishing scams if you only accept certain notifications from specific trusted npubs, similar to how Damus separates DMs?