It's because so much of corporate security is based on whether a user trusts a piece of code in an environment where they've gotten used to trusting new pieces of code. At my job, so many things ask for the one password that protects my full account that I wouldn't be surprised if someone sneaks in something that both legitimately uses it to log in to something but also saves the user/pass combo and it would likely succeed completely at getting a bunch of credentials.