setupBaseUser calls getRelationOrDefault on a number of critical user relations. However, it doesn't call hydrateRelation on those entities User relationship.
My use case is making Auth::setPassword have additional complexity rules such as forbidding public or easily obtainable information as part of the password on registration.
A user's email address should not be allowed as their password