..so really at every level they seem to be following best practice here.
I believe you that, but I strongly doubt that inexperienced or new users are aware of that. The login process simply demands too much pre-existing knowledge about the system and without it, the whole login process looks like a scam.
I can see how you or anyone could come to that conclusion, I don't debate that it should be clearer, I'm just trying to make it clear to you, here 🙂 The ticket has been accepted so looks like they will do something about it.