These are not authentication mechanisms, they are error detection mechanisms. This article (and these error checking algorithms) predate the time in which anyone could just throw data at a centralized API to see if you can get a 404 or 401 in response. A lot of the systems that used these numbers in the 20th century were offline and/or slow to process. e.g. the Luhn algorithm which credit cards use was invented in 1954.

Also EANs/ISBNs don't have other authentication factors available. You don't want a mis-scan for product A to accidentally charge a customer for product B. You want to detect the mistake.