Because it's easier for a particular department to buy a domain than it is to tell whomever manages the microsoft.com domain to create a subdomain.
They do seem deliberately designed to be suspicious. Almost couldn’t be any worse even if they tried.
Particularly for unimportant things like authentication. There must be at least a dozen redirects when you login with your ms account online, none of which is a microsoft.com domain.
microsoft-internet-security.com
Every time I get an email from my health insurance, or sign in, I see so many domains that look like abject phishing domains. It's insane.
aka.ms
Because Microsoft isn't a reputable company and engages in nefarious activities across the web to maintain a positive reputation?