Because if you're not using an authenticator, you're being silly in thinking your account is secure. That's why. Email address + a password that's not case-sensitive with no backup is just asking to get hacked.
Blizzard did its customers a disservice by not posting something like this before the game was released:
http://us.battle.net/d3/en/blog/6020037
Is a mugging victim silly for not carrying a gun and staying near a police officer at all times?
It is extraordinary that D3 seems to require an authenticator to keep the player's data safe. Other than WoW, I'm not aware of any other game for which this is necessary.
Does Blizzard make the need for authenticator use evident in any way or at any point in either the boxed or digital download editions? Do they even mention authenticators? (I have to ask this because I have not yet bought the game, and will not until these security issues are resolved to my satisfaction).