Except that users are really bad at choosing strong passwords. A significant percentage will even use the same email/password combination accross multiple sites. For a site which contains sensitive financial or medical data, it is better to issue a 'username' that contains random characters. (This is the technique the UK government uses when users log in to pay tax)