Yes they do. But don't underestimate how much people don't actually read their emails. They have 20 newsletters coming in every day and quickly check if anything is related to them, they have no idea what that iCloud email says. They just fell victim to a phishing attempt, they are already not that tech savvy.

You don't need to check email on Android, Google Play Services triggers its own notification. Others here say Apple does similar.

I had this idea for a service just the other night : a means of overlaying real time messages and alerts direct to any app you are using at the time. Kind of Class 0 "flash" SMS.

EDIT : it chould be a OS graphics layer service capable of drawing alerts on your active window. But I don't see why display manufacturers couldn't make this useful : the number of screens and applications anyone is logged into at any one time is increasing, and the primary screens we're using commonly have Windows Hello and Face ID type of biometric capabilities, which would be very useful for establishing the likelihood of unlawful access elsewhere.

EDIT 2: So Apple has a good position from which to offer this kind of "where are you working from?" heuristic check available to other security system software.

EDIT 3: Biometric presence data as a service to increase security for administration changes and logins hasn't come to my attention as being explored yet. I'm semi retired and extremely interested in this area if anyone is interested in a wider discussion in London - not burdened with any expectations or intentions and able to arrange professional legal cover if desired / necessary - I am interested in derivative applications for services that don't yet exist

Apple makes me authenticate the new login using a six digit code from one of my other Apple devices, which is generated if I hit "Yes" in answer to a push notification asking if it's really me trying to log in. All logged in devices get the notification, and then upon a successful login all devices get notified of the new login.