While still imperative to get right, passwords aren’t nearly as secure as you would expect them to be. They can be guessed (especially if proper password practices haven’t been followed), stolen in data breaches, or phished from a well-meaning employee.
Passwords are essentially the lock built into the front door of a building. They’re enough to keep out honest people, but what about the people who are willing to go to the deep web and 3D print the master key to the type of lock you use?