Because passwords are terrible.

Lots of users pick guessable ones unless you have extensive password rules to stop them, and those rules are a huge pain to your users.

Lots of users have terrible password hygiene, leaving them all sorts of places they shouldn't.

Enough users are going to forget their passwords that you need a recovery mechanism. Which means an attacker needs to break either the password or the recovery. The most common recovery method is email, but Google often is the email provider.