Password managers are already a barrier. Forgotten Password flow via email is an embarrassingly shitty UX and similarly shitty security protocol.

I wouldn't try to encourage the broken "Forgotten Password" protocol... it's usually the softest target of authenticating on the web.