You're totally correct there. I have followed several events on their blog and they have managed to raise good investments from venture capitalists with a legit team that doesn't hide behind the shady domains. Having access to user funds will not impress any investors to put any money on the start-up as they know the market evaluation will drop drastically if someone with the lost password claims their coins have been moved.