This is called an identity first workflow and is used specifically so that they can route different people to different login ceremonies or providers.

They get your id first, and use that id to determine what your login ceremony is. Perhaps you’re with a business that they have an sso integration with and will send you on to your businesses sso provider, or perhaps you’re a local user for them and get a password screen next.

Different domains need different authentication flows. If the provided email ends in a domain they recognize, instead of prompting for a password you’d be sent to another auth provider to authenticate there.

This is generally done when you have customers with SSO, the first one will take the email and if the domain is ssod it forces them through a particular workflow. Otherwise you get the other normal username/password flow

I always assumed some sites harvest what ever you enter in the first box. Especially if it’s an email address. But other people in this thread have the legitimate answer.

Sometimes it's just UI/UX, sometimes it's to deter specific patterns they've seen from bots, users, or brute-force. It's really just subjective. One isn't necessarily better than the others though it does mess with automated input of credentials a lot of times.

Some sites check if the account does not exist yet to show a registration form.