Tl;dr: because i am unreliable and lazy. Asynchronous authentication is hard, and God in heaven have mercy, but i am simply not smart enough to "roll my own" login system in the Year of our Lord 2025.
This way, the security of your account is between you and your email provider. Plus you can spam your friends' email addresses with login links to harass them into joining.