>on the one hand it's insecure because it is a 1/12 chance of guessing right, but also who remembers what month they created an email account?

IIRC, they require both month and year, so there'd be a bit more guesswork involved. I added the exact creation date for all my Google accounts to my password manager when I learned about this verification method.