Because PAM is the default authentication framework on all those distros. Yes, it's a disaster of complexity and something pretty much no one understands. But it's what we have.

Maybe a rearchitected replacement will land in systemd someday...