They are meant to be typed either by looking at or from memory.
URLs work regardless of capitalization; /Mfa, /MFA, and /mfa are treated the same.
Handles similar-looking characters seamlessly, such as (/T0T is same as TOT, and BIT same as BlT).
They are small because they can be reused over again.
Organizations are free to make strategy and use dictionary words like fnb.3u.gg/ForgotPassword.