The point of the cookies being HttpOnly is that it makes them completely inaccessible to client side JavaScript, making a whole load of session hijack/XSS attacks impossible.
The request for a bearer token here circumvents this protection because then there’s a way for a client to avoid cookies all together, making the API vulnerable again.