You are assuming that if member validation is enabled, that everyone will validate. This isn't true for anyone that signs in with an SSO (be it Custom, OAuth, Facebook etc) or anyone that registers (when purchasing an item) in Commerce. You would be better to just use onCreateAccount() and make sure you have onDelete() supported for accounts that get removed (currently there are only methods for onCreateAccount() and onValidate())