Cost/benefit I imagine. It makes the widgets much simpler to manufacture, distribute and use.

And the risk, from what I can see, is pretty low. It would have to be a very focused attack to clone my card & get all my auth info for my online banking account since the two sets of data (card + online auth) don't intersect anywhere normally.