I get "logged in from a new IP address!" alerts with a service I use almost every time I log in, even though my IPv6 prefix hasn't changed. Deciding it's a completely new IP just because something changed in the last 64 bits is probably a bad idea in a v6 world.
Devices being multi-homed is intended to be standard practice.
My iPhone regularly has multiple IPv6 addresses, with different reachability characteristics for different addresses. There's an address used by my carrier for voice, there are addresses I locally administer, there are addresses from a stable prefix I use, addresses from dynamic prefixes provided by my upstreams, ...
The v6 world is a world where many devices have many addresses and addresses do not all have the same scope.
Application developers are going to need to get used to this new normal.
An application I manage has ~40% of users accessing it over IPv6, most of which would have a degraded experience if we didn't offer v6 connectivity.
IPv6 is here, it's here to stay, and applications are going to need to understand the new world they live in.