One reason is that there's a very small distance between "I don't care if someone gets in here" (reddit, blog, etc) and "If someone got in here I'd be hosed" (bank, administration stuff, etc). OpenID can handle the former, but since people are using the same insecure password for all those sites anyway, typically, it doesn't matter. OpenID can't handle the latter, because (last I checked) making phishing easy is inherent in how OpenID works.