Please explain why, simply saying its not doesn't really add anything to the conversation nor convince me otherwise.

I'm not sure I understand why not. With your common URL method theres still two ways to authenticate, just as there is mine. They could "guess" the reset key just as easy as they could "guess" the new generated password. You'd have both expiring so the period for attack is minimal.

Please explain how my method is any less secure? Perhaps I'm missing some key security principles (likely), in which case please guide them to me. But just repeating that its less secure without backing up with some logic really doesn't convince me nor teach me anything.

Edit: I forgot to mention apologies - I'm not saying the password should remain as the one that was emailed. You can and should force people to change it upon the first login with their new password. Perhaps thats where the security confusion was. People storing passwords in email is poor, theres no debate there. Though yes, at a second thought this puts an extra step in for the user - A/B testing would be of use here.