Because it's 1 year + 1 month + 1 day.

1 year (366 days): See the ballots and accompanying discussion linked in other comments about the proposal to reduce validity to 1 year.

1 month (31 days): Grace period for human beings, to permit weekends, vacations, and continuity handoffs.

1 day (timezones): Grace period for browsers and shared libraries, to survive the timezone math issues with "It's one day greater than today somewhere in the world". This ends up baked into the process as follows: Certificates will be issued for "397 days or less", browsers and libraries will validate as "398 days or less".

With 13 months, you can renew your certificate once per year and still have one month of buffer time. But in 2 or 3 years the maximum length might be tightened even further. At least there has been such a trend of length decreases in the past.