I cannot speak for the gcloud cli devs, however using the gcloud auth method, org admins can ensure that session timeouts are followed even with the gcloud command. This means if you use ADC with your user, you will have to re-enter your password once the session is over if you want to continue to use them. From a security perspective, GPG password protection does the same thing just with a different session length. For service account keys, there is no session timeout at all.