I think the main problem is the effort of having to maintain a client certificate. I.e, backing it up and copying it on to other devices. It's so much easier to just remember a password, or write it down if you can't do that.