It actually is very hard. There’s a long tail of concerns that make it difficult to do authentication as well as a major player in the space.
Farming that responsibility off to Google or Facebook and letting them handle the edge cases (for free, I might add) has genuine security value.