Recovery is the security boundary
The password usually protects local access; the recovery method controls restoration. Never enter a Secret Recovery Phrase into a website or provide it to support. MetaMask cannot reverse an unauthorized blockchain transaction.

