Recently setup a family member with a new iPhone and they had no idea what the password was. Password reset flow worked without any issue.

I forget why but it doesn't work, probably because it sends to some email they've never heard of.

It does work. As I said, I had to go through it with a family member a few months ago. It's hardly Apple's problem if a user forgets their password AND email address.

I don't expect Apple to get someone back into an account they've forgotten everything about, but you shouldn't need to do that just to download a free app. Grandma already knows her passcode, that should be enough.

Not when you have a recovery contact.

There are like 10 grandmas in my extended family (in-laws etc), none of them know their Apple ID passwords, none have recovery contacts. They probably forgot because it never asks for that password except when they want to download a free app, cause for some reason that's a highly sensitive thing.