Probably for the same reason that every trivially simple web app is now a bloated React SPA - because it's all that many devs have ever known.

They graduate and join companies where everything is built in an insanely over-complicated, over-engineered fashion using fifty layers of complex tooling because "that's how Google does it" and the senior engineers wanted to learn something new. So they assume that this level of complexity is necessary because companies wouldn't do everything this slowly and painfully unless they really needed to, right?

Then they pass this lack of wisdom onto the next generation of juniors, and the cycle continues until no-one remembers that it doesn't have to be this way, to the point where people think that paying $99/month for a third-party tool makes more sense than "having to deal with your own authentication", as if authentication is some huge burden and not a basic cookie-cutter feature that's as old as the internet.

By the way, in Phoenix you can get a fully-featured authentication system for free in literally ten seconds: just run `mix phx.gen.auth Accounts User users` then `mix ecto.migrate`. There, I just saved you hundreds of dollars.

This is rarely a solid argument for doing anything in & of itself. Even less so when security is involved.