There are known good practices for password reset functionality from OWASP and other resources. On the other hand, I believe most of us agree that security questions are not user friendly, they either make users choose easily guessable answers to questions like "whats your favorite color?" or in case the user forgets the actual password, most likely he won't remember the security question either.
So we see many websites delivering password links via email, the login can also be enhanced with second factor authentication via email or text messages.
In our threat model, suppose we have a mobile payment application, and we want to protect the user in case his mobile phone is stolen or accessed via malicious actors. We assume that the mobile is broken into (there's no password set on the device), now if an attacker gains access to the device, most likely he also has access to the email address which is setup on the device, so he can request a password reset on installed applications and break into them, unless security questions are used but I'm against this solution because of aforementioned issues.
My question is, first, is this threat model valid, because I haven't seen it being taken into account in many mobile payment applications, and second, how hard would it be to protect against such attack scenario and what are the possible solutions since most of side channels (OTP, Text Message, Email) are setup on mobile devices.