At least the way they do it now gives some control to the org as to who has access to their account. It's inconvenient but it biases towards making on boarding hard to make control and off boarding easier.
Also, GitHub wants to avoid the same person having multiple accounts. Their focus is the developer, not the org. So they want all your work to be associated with you.
I still have stuff on my account that is associated with Netflix and reddit. Because the account is tied to my personal account, those orgs can never "remove" my contribution.
This portal is really nice compared to the previous system, which was send an email to someone and wait for them to get to it. :)
Previously you could only add a user to your org by knowing their GH username. I was always paranoid I was going to typo and release my code to some random user.
For a while we hacked around this problem by letting third party associates "invite themselves" using a one-time use token in our portal, but we moved away from that since we no longer join externals to the org.
We're thinking of bringing it back, though, for "Outside Collaborators".