> Why do device manufacturers refuse to support this configuration?
My theory is that it checks boxes for "sEcUrItY."
There aren't enough enthusiasts who know the first thing about computers or security to be a market for any mass-market hardware, so they're designed for the proverbial "grandma" to be able to plausibly use. Therefore, you can't ask them to establish, remember, and maintain the secrecy of any credentials.
Therefore, they either need to make the devices permissively trusting on the LAN (which IoT devices got a lot of criticism for a few years ago) or they need these fluffy login methods that introduce dependencies: Usually they require email for forgotten-password recovery, SMS for a "sEcOnD fAcToR", and of course, because it would confuse people if the control only worked on the LAN without integrating into a home hub, they need every device to connect directly to the cloud and therefore for the app control to go through the WAN. Or at minimum, the LAN<->LAN communication is only permitted by possession of a JWT or similar that's been recently authorized by the cloud server.