Same reason https://sshfp.github.io/sshfp.html exists, anchoring SSH fingerprints to the Web PKI: it's a convenient distribution method. Which helps, because people suck at distributing fingerprints. DNSsec and the Web PKI take an equivalent role here, I'd say.

Alternate solutions I'm aware of would be SSH certificates and querying LDAP. One of the issues with SSH certificates (AFAIK) is that they become rather cumbersome when administrative domains aren't cleanly separated, which is quite common once you're outside rigid and obvious organizational structures that reflect into sysadmin. LDAP has the same scoping issues, except even worse.

> You don't need any third-party PKI to get optimal SSH security!

This is a very binary view on an issue that is all about grimey, squishy user behavior. Sure, if users copy around SSH fingerprints, they don't need this. And either way they don't need it very often. But have you met users? The Web PKI goes to great lengths to avoid people shooting themselves in the foot (on both server and client side), why not look at some options for SSH?