Why does a quality model for authentication include governance criteria such as supervision, liability and maturity at all?

Because a relying party trusts the operator, not just the technology: it needs assurance that the provider's processes are actually followed, checked by someone independent, improved after incidents, and backed by someone who pays when they fail.

All other sub-models describe what should happen: identify the person this way, hand over the token that way. Governance asks whether that is really happening, day after day:

• Supervision answers "who checks?". A provider auditing itself against its own rules gives little assurance; an external audit, or one by an officially accredited body, gives an independent view.
• Liability answers "who pays?". If a provider bears no liability, a relying party carries all the risk of a wrongly issued identity. Legal liability, and at the top level an additional contractual penalty, gives the provider a financial reason to get it right.
• Maturity answers "does it learn?". A provider with only initial, ad-hoc processes may perform well today and badly tomorrow. One with measured, optimised processes detects incidents itself and adapts quickly to new attacks.

Without governance, every other level is only a claim on paper.