I addressed this briefly in my last update but I can give more clarity here.
We didn't feel it was appropriate just to port everyone over into our userbase and auto-create accounts for them - we made it opt-in because it was the lesser of two evils. It's slightly inconvenient yes, but our user account structure is slightly different to the old cakewalk structure so it wasn't exactly 1-1 and we wanted people to have the freedom to choose.
We didn't want to force people to have a new account without them realizing (or asking for it) nor did we want inflated user numbers (on BandLab) that weren't interested in being part of the new setup on the go forward. Confirming your account verifies the email address, so we don't have to check IP addresses etc.
Historically on the Cakewalk database, email address was the only unique index in the table too. We were also aware of a lot of invalid email addresses etc, so we didn't want to load rubbish in!
Hope that makes sense!