Why is a wordpress login session limited to one domain

While www and non-www versions of site are considered kind of same thing from user perspective, technically they are two completely different domains, possibly hosting completely different sites on different servers.

Since cookies are domain-specific WP treats them accordingly.

It’s not impossible to rework this, since cookie-related functions seem to mostly be pluggable, but really the most common and practical solution is to have canonical version and have other redirect to it.