No the onus is still on the user. How does the onus move to the channel provider?

I don't see a difference in this and 'Reset your password' links in emails that are common place. They are basically the same premise, without the password.