honestly I think a lot of folks are still stuck on user:pass just cause they don't want to deal with the setup of IP whitelists. It's lazy but also cheaper in some cases. But yeah, it's risky and imo most legit providers have already moved away from that old school method. Still, u gotta watch...