Because nobody requested it.
Personal feeds, APIs for the mobile apps, mechanisms to deal with spammers, instance filters, all of those were requested and got delivered.
I am happy with the passkey option, I assume other people too.
Also I remember Lemmy 2FA causing some issues at the beginning, locking people out of their accounts.