Old accounts become actively again after several years of inactive don't trigger any security alert if email address was not changed almost immediately after waking up account password was not changed almost the same time too

So with such accounts, no suspicious things to trigger anything in account security and it does not relate to account recovery. It seems you try to make account wake-up and account recovery as the same, while these activities are complete different.

Accounts that have suspicious activities can be locked even they don't use the security question.