Why does a combination of two passwords not count as multi-factor authentication?

Because MFA requires factors of different kinds; two secrets you know are both the knowledge factor and fall to the same attack, such as phishing or a keylogger.

MFA can be reached in two ways:

• a) a single multi-factor authenticator, which combines two factors in one device (for example an OTP app that only shows codes after a fingerprint or PIN unlock: possession of the phone plus knowledge or inherence), or
• b) a combination of two single-factor authenticators with different factors, for example a password (knowledge) plus an SMS code to the registered phone (possession).

The word "different" is essential. The point of MFA is that an attacker must succeed with two independent kinds of attack: stealing a secret and stealing a device, or stealing a device and faking a fingerprint. Two passwords, or a password plus a security question, are both knowledge. A phishing page that asks for one will just as easily ask for the other, so the second secret adds almost no security.

Go deeper:

• Multi-factor authentication (Wikipedia) — the factor categories and common MFA methods.