I don't think it's old design myself. I think it's "how little can we require so that people don't call on the telephone or get in line at the airport?"
Any barrier you put in front of them increases support calls or slows down the check-in line.
Airline websites have logins, passwords, resets, and so on. They just don't want to make that a requirement to get a boarding pass, etc.
This isn't correct. You can have a PNR in a GDS, but you don't have to. The airline has their own central reservation system with the authoritative PNR. The CRS may be provided by Sabre, Amadeus, etc, but it's not a GDS...that's separate.
>They still go through mainframes
Some have moved entirely off of TPF mainframes. Amadeus/Altea is one example.