To prevent unauthorized access if your password is stolen. Even with your password, a hacker cannot log in without also having your registered phone or active device.