The idea is that you're implicitly trusting the company (or website), as well as anyone who has (whether legit or not) access, to only keep that password in memory, and it's preferable to authenticate without requiring that trust.
But still: I just can't get worked up about this at all. I'd rather see pgp get implemented in browsers before this.