The threat model here is people leaking their own Coinbase passwords (via phishing, compromised PC, etc.), so the 48-hour delay and out-of-band verification ought to actually help.