This is the tragedy of the commons, online security edition. It makes sense for each of these companies individually to make their sites hyper-secure, but becomes intolerable to the consumer.
I think it is known as Anderson's rule, named after the late Ross Anderson, which is that any system must either be vulnerable to hacking or intolerable to use.
I've been paying some bills. I am absolutely certain that with passwords, codes and approval codes included each one takes longer than it did 30 years ago.. when we just wrote some cheques.. and dropped them in the post box on the way to the shop.