It's a tradeoff. If you roll your own password flow, you need to add MFA to be secure. The complexity of what you need to build and maintain goes up.

A simple magic link flow for an app like this, where you are really only likely to log into it once per project you start.

Personally though, I also use a password manager. And I am annoyed enough by email magic links, that any of my personal projects will at least have a passkey implementation.

So I agree they're annoying. But they're definitely not "dumb". They're a tradeoff. This developer has chosen his own time over user convenience; which is a common tradeoff for small developers.

True, every login must be standardized around social auth and oauth2