Should we implement email confirmation on change?

[milenmk]

The default application and starter packs use the email of the user as a username for authentication. If an account is stolen/hijacked/breached, the attacker can easily change the account email with a few clicks.

Most website requires a confirmation when the email address is changed to safeguard against this and implement an additional layer of user account security.

I have created a composer package for this purpose, but do you think having this on the application level is reasonable?