So it seems to be based on their own experience. The parent comment says this:
"When I switched from user / password to OAuth I couldn't believe how many users choose it. I could deactivate traditional user & password login and nobody would notice it."