I imagine it's because they would be (legally) responsible for any malicious usage of your account.
Based on what? Have the laws changed, or has there been a recent ruling on something related to this?
"I imagine" which means they have no idea what they are talking about