> of reasonable suspicion that they're compromised

Or more likely an automated unreasonable suspicion

> Should it not?

Yes, it should never ask you for a confirmation that is impossible, this is a simple nonsense of design. Also, months is not a useful tradeoff