It still feels marginally better because it requires making a change that is visible to users, vs the normal case where a server can surreptitiously collect passwords. It also works nicely for the mobile app login case.