As a bank we do the same thing. Driven by the fact we don’t want our login emails to come from a domain that also sends “normal” emails in case spam filters start dropping emails from our primary domain.

This isn’t a hypothetical concern either, having spam filter go crazy happens more often than you expect, and some of them drop emails completely rather than putting them into a spam folder (looking at you Microsoft).

Unlike PayPal we make it easy to verify our domains. https://monzomail.com