Another issue that was not discussed here is the threat of fraud. Although standard ISD requests are the more common type, I imagine that self-certified hardships (without any involvement from the employer) could lead to nefarious activity by scammers. With hardship documentation required, there are at least other means to determine that the person requesting the hardship is indeed the actual participant. With employer involvement, they can actually check with their employee to determine if a request was made.
Although online requests at least block people behind a username/password (and, hopefully, MFA) security, it can still be hacked. And, with forms, it would be even easier for a scammer to complete it, self-certify a hardship, and get a fraudulant distribution.