And the second question then becomes, who is the right person, the user or the developer, to answer the first question.
Users are almost always the wrong people to ask when it comes to technical questions.
Yes, but the risk that forgotten password poses is not really a technical question, is it? I would say it's more like a behaviouristic question.
Anyway, I'm just one of those users that dislikes it when an application thinks it knows better than me what's good for me.