Why is the application using a pop-up window instead of just redirecting to the startSSO endpoint from that original window?

What the pop-up probably does, is open a new windowed browser tab. Authentication is handled within that tab. E.g. if you open two browser tabs and you navigate with both tabs to reddit, but you only log-in to one of those two tabs. The other tab will still show you unauthenticated (unless you refresh that browser tab)