Because they have never been required to be, so contextually they have no framework to go off of. Everything is backed up by email or 2fa. Confirmation by text even.