This reminds me of why I'm very nervous I've been able to login to LinkedIn by just click an email LinkedIn sent me; and to someone else's Netflix account from an email that was sent to me by mistake.

You _could_ blame the users for not setting up 2FA. But two wrongs don't make a right, and these websites should always ask for another means of authentication, even if it's just a password. Url parameters in links don't count.