A login is a claim with varying degrees of confidence behind it
Authentication methods differ substantially in how much genuine confidence they provide that the party authenticating is who they claim to be. A password typed from memory offers a certain baseline of confidence, undermined by the fact that passwords get reused, guessed, and phished. A hardware-backed key combined with an additional factor offers considerably more — not because it's more convenient, but because it's structurally harder to fake or steal.
Treating a successful login as a single binary signal — authenticated or not — discards this distinction. Two logins that both succeeded can represent very different levels of actual confidence, and a system that doesn't distinguish between them is making every downstream decision on the same footing regardless.
Matching the tier to the stakes
The practical use of thinking in terms of assurance levels is deciding, deliberately, what level a given action requires — a low-stakes read might reasonably accept a lower tier, while an action with serious, hard-to-reverse consequences warrants requiring a higher one specifically for that action, even mid-session. This is the same underlying idea step-up authentication applies operationally: the required strength of proof should track the stakes of what's being authorized, not stay fixed for an entire session regardless of what happens during it.