Centrally Managed Users in 19c Password Based Auth Password Filter

I'm looking to test CMU. I note that it requires the Active Directory Schema to be extended and a password filter to be installed in order for password based auth to be support (as per here.) I'm struggling to understand why this is? It seems like this is to:

1. allow the password filter catch password changes
2. write them back to the orclCommonAttribute attribute it added to the schema
3. Sync this back to the Oracle DB

Why is this necessary? I would have assumed that OracleDB in CMU would simply take the username/password supplied by the user and use validate it against AD directly no?