This is a security vs. usability tradeoff, and while many people here would take security over usability any day of the week (which is what this feature finally provides as an option), Apple caters to much wider audiences. People tend to forget their account passwords, and having the option to reset their Apple ID account password with two other factors ("something you own" being the device, "something you know" being the device's passcode) comes in very handy. I know people who neither remember their passwords nor want to use a password manager. So having a simple way around that by default that's at least somewhat secure and now having an option to increase security seems like a good solution. Even though I would've liked to have an option to completely disable messing with my Apple ID using any form of device authentication.