Unfortunately because nobody has stepped up to do it. Same reason anything else isn't in core.

I have to agree with Carl though, been asking myself for 5 years now; it just seems like a mandatory thing to have for anything outside of "let's fetch an archive of our latest posts". I'm genuinely surprised it was launched without it. Was lower SSL adoption the reason?

I remember someone (perhaps @rmccue) was working on something around OAuth2 a few years ago, but no idea where that ended up. IMO OAuth2 should be built in as a minimum, in core. Of course I have no ability to contribute to this apart from saying it should be done.