As an extra layer of security, not the 'singular' layer of security, the drawback you mention doesn't apply. It would have uses outside security too, for exampl

As an extra layer of security, not the 'singular' layer of security, the drawback you mention doesn't apply. It would have uses outside security too, for example user identification and profiling purposes on websites. I often wonder about sites where users usually type in content, and what information could be gleaned about users by their operators.