EDA is great but it doesn't meant you should use it EVERYWHERE in ANY case. EDA purpose is to provide decoupling and scalability and that is achieved with the trade off of not having immediate feedback and dealing with eventual consistency.
Also at least in web apps, it's best that EDA to be implemented as a Domain Event Architecture, that is those events communicate that someting related to the domain (business) has happened.
You're right that events are a 'fire and forget' type, because they express something in the past, published so that other interested components would be notified. But the catch is those components don't know anything about other components or the source of the event. Remember, the point is decoupling.
User login and such aren't domain actions and it's much easier and maintainable to implement them the 'old' way. And while you want some decoupling, it's more about low level than about architectural (high) level decoupling.