When a business starts, one person signs up for everything using the address they already had. It is the obvious thing to do and there is no reason to do otherwise at the time. Years later, that same address is the recovery point for the domain, the bank, the payment provider, the accounting system, the insurance and thirty supplier accounts - and it is a personal mailbox belonging to an individual rather than to the company.
The exposure is easiest to see by imagining the address becoming unavailable. If it is a free mailbox and gets locked - a suspected policy breach, a security flag, a forgotten recovery step - every service that uses it for password resets becomes unreachable at once. Not one account: all of them, simultaneously, including the ones needed to prove identity to the others. This is the same trap as the lost phone, with a longer reach, because email is the recovery method for nearly everything.
There is a second version that is more common and more awkward: the address belongs to someone who leaves. A partner, a founding employee, a relative who helped at the start. Their departure need not even be acrimonious for the business to discover that renewals, verification codes and account notices are going to a mailbox it does not control and cannot ask to read. Resolving that later requires the goodwill of a person who no longer has any obligation to provide it.
The fix is unexciting and works. Create addresses that belong to the business, on the business's own domain, for its functions rather than its people - one for accounts and billing, one for administration and registrations - and move the important registrations across one at a time. Function addresses can be redirected to whoever currently holds the role, so a change of staff becomes a change of forwarding rather than a change of identity on twenty accounts.
Do the domain first, because everything else depends on it, and be aware of the loop: if the domain's registration is tied to an address on that same domain, a lapse takes out the warnings about the lapse. The registration contact should be an address that survives the domain - and, like the rest of this, it should be written down somewhere the business can find it without the person who set it up.