Why doesn't Netflix require users to be logged in before they can change their card details? That seems like the biggest security flaw, not the Gmail dot alias.

(I'm guessing they did A/B testing and found that having to log into your account lost them some percentage of people. If that's the case, Netflix are clearly putting their retention rate ahead of security)

There's probably a not insignificant number of people who are happily using a dotted variation of their gmail account. Putting a big warning above the email wouldn't make them very happy.