Its less to do with a limitation of nostr and more to do with the 3rd party app devs taking shortcuts.
If they really cared an dummy easy way to things would be to
1. Have a nostr handle for their service.
2. Use visits 3rd party site and the sites gives them a randomly generated code to post to the nostr handle in 1.
3. Authenticate the use.