Requiring email verification to activate an account is the bare minimum to slow bad actors. Not doing it is lazy bullshit.

It also allows using someone else's email address to create account & using them until the email owner notices & acts.

Bluesky has put the burden of security on victims.

This is a test:

I created this account with a non-existent email address.

I'm testing to see if I can use this site and make posts without first verifying that email.

If I can that's bad - the bare minimum security would require email verification before use is allowed.