Convenience without duplicating the exposure
A derived credential is provisioned onto a new device, typically a phone, from a stronger, original credential such as a hardware smart card — without the original ever having to leave its secure location. The phone can authenticate on its own using the derived credential, while the original stays exactly where it already was, untouched by whatever risk profile the new device carries.
The naive alternative — copying the original credential itself onto the phone for convenience — turns the phone into an equally sensitive target as the original hardware token, inheriting every one of its risks (loss, theft, malware) without any of the protections the original's dedicated hardware provided. A derived credential is deliberately weaker in scope and independently revocable, so that compromising the phone doesn't mean compromising the original credential at all.
Scoped and revocable independently of the source
Because a derived credential is provisioned separately, it can be scoped more narrowly than the original — limited to what's actually needed from the phone specifically — and revoked entirely on its own if the phone is lost or compromised, without touching the original credential's validity at all. The original stays available to reissue a new derived credential to a replacement device the moment the old one is revoked, rather than needing to be recovered or reissued itself.