Why the Something You Know Factor is Considered the Weakest in Authentication

Question

In authentication systems, the Something You Know factor, such as a password or PIN, is often labeled as the weakest. I’m trying to understand why this is the case. Is it due to human errors like weak password choices, susceptibility to phishing, or technical vulnerabilities like brute force attacks? How does this compare to Something You Have (e.g., tokens) or Something You Are (e.g., biometrics) in terms of security?