It’s a cost/staffing issue. The cost to serve password resets due to forgotten passwords is lower than the cost to respond to “My account got hax0red!” customer service requests (which usually boil down to messy identity management issues).