The problem here is that the most reliable delivery channel (email) is not sufficiently secure enough for a lot of situations. Worse, some users share email accounts, so you can't even depend on the auth of the account. If an app or service has to achieve a certain level of security, it can't rely on email as a direct message channel - it can only really use it for notifications that a message is available.

Contrast that with Android apps, where the app can show a notification at the system level but then handle (or retain) the service-specific login (and/or respect its rules about timing out the login.)