Because the client isn't smart enough to understand that if the IP you're being logged in from doesn't change, that there's no reason to need to put in the one time password again. You know, unless the RMT physically break into your house or something.

That said, as session IDs never expire, somebody can hack your account and log it in with neither your password nor one time password from the other side of the world any time they want, because SECURITY!