Because authentication is coupled to authorization and authorization is coupled to business rules and data access. If your program does not deal with business rules and data access then it is probably a single-user program (that does not need authentication).

I'm over-simplifying of course, but these things sound simple until you ask all the "but-then" and "what-if". If someone actually makes them simple in a way that still lets me cover those cases I'll be the first to stop writing authN/authZ code.