Because they have to be able to act upon invalid / spam / bot / brigading voting if it happens. And there is not a reasonable way to do that without knowing the voters (not necessarily the votes) that is not "disable votes for this particular subject".

It isn't true. As far as I can tell there is nothing right now which prevents me from sending a fixed, unique token for any give action from my test instance instead of the user string itself. Only comments would require the real user string, for obvious reasons. Likewise, another instance could ban that token, or the user or both. This actually does nothing to change the trust model, but would significantly enhance privacy and reduce the propagation of user telemetry.