Because every OS they ship with they need to support. Lenovo already has a viable, cost effective, support model for endlessos because they ship and support it for educational customers.
It’s not commercially viable for them support other OS that there is near no demand for relative to their overall sales.
As you suspect, only during the sixty or so seconds that they are valid.
SMS-based codes tend to be longer lived.
They're useless without your other authentication factors, e.g. login, password.