What's so hard about login to get code if they didn't want to do the migration process when that's something even sites like humble bundle and other online stores offer without offering direct downloads of games or anything like that. Or even send a code to their email with an expiration date after closing the migration process for good. When poorer sites can do it what's Microsoft's excuse.
What? Do you know how redeeming codes work? You create an account like on steam, origin, gog, xbox, Blizzard, or UPlay and go to activate game and enter in your code.
I don't know what tangent you are going off about that method being an unreasonable amount of work. What are you even arguing about.
Have you really never redeemed a code ever in your life that you see it as illegal activity and a security risk?