I don't get why we still use security questions for everything

I see everyone setting up security questions like 'What's your mother's maiden name?' but I think it's a weak link. Hackers can often find this info on social media. For example, my cousin had her account breached because the answer was on her Facebook profile. It seems like we're relying on outdated methods. Why not use better options like backup codes or authenticator apps? I'm just not convinced this is the best way to keep accounts safe.