I think we, "people", pushed companies to do this.

There are billions of people creating various accounts. Hundreds of thousands of them had a weak password, or told their password to someone, etc, and their data leaked. There were so many news about "data leaks" and "security issues" in the past 20 years, and each time, a company was blamed, never a user.

We even made laws, where letting people log in with only a password can be illegal.