Certainly there's plenty of hype and herd behavior in this industry, but underlying this is a simple desire: don't allow users to give their passwords to a third party. Or rather, they can do that but the third party won't be able to authenticate because they don't have the smart card or 2FA dongle.
Often there is a requirement in commercial contracts requiring adherence to certain security standards. An example of such a contract is liability insurance.
