The old stuff is still around because it works.

New fancy integration, digital signatures, etc are still protecting a process that’s unreliable fundamentally. It’s all anchored to your birth certificate, and in the US that’s controlled by thousands of jurisdictions with varying competence.

The most secure scenarios (cleared employees), tie your credentials to biometrics, and vet your origin as a control for fraud. Everything else increases the risk of fraud as a trade off for convenience or privacy. (Your cellphone carrier doesn’t need to vet where you went to elementary school)