I have it on good authority that some people use the same static email address their entire life. And some don’t even update their passwords, nor add 2FA.