It was the simplest/cheapest form of 2FA to implement. Grandma will never understand how to setup TOTP.

Capitalism requires regulations, otherwise it will ALWAYS do what is cheapest or most profitable, regardless of how dangerous or destructive.