They often do; it's two-factor authentication that's the problem. If they'd support some open standard like WebAuthn this problem wouldn't exist, but they all insist on using home-grown solutions.