User blog comment:Rappy 4187/Technical Update: August 31, 2015/@comment-5558012-20150901003221/@comment-24473195-20150901062401

"How so? If someone compromised an account, why would it be harder to change settings? There's no confirmation for changing settings."

I suppose you're right if they simply add a checkbox. But they could require confirmation just like they do with the password. It depends on how they implement it.