They also have rules against being logged in for too long, and against identity transfer (directly or indirectly using BankID to authenticate for a different login method) [1], since that would result in fewer BankID logins and less revenue for them.
One result of the latter restriction is that any letters containing authentication codes need to be sent by physical mail, since all digital mailboxes such as Kivra and the government-run "Min myndighetspost" support login by BankID. The University Admissions service (antagning.se) were forced to stop sending codes through digital mailboxes due to this [2].
[1]: https://twitter.com/antagningse/status/1178957770978140160
[2]: https://computersweden.idg.se/2.2683/1.643894/skatteverket-s...