ERC-20 uses a permissionless transfer model: any address can send tokens to any other address. That works for utility tokens but conflicts with the legal requirements for securities.
Swiss laws such as the Financial Market Infrastructure Act, the Banking Act, the Collective Investment Schemes Act and the Anti-Money Laundering Act, together with FINMA's guidance on ICOs, require issuers of asset tokens to control who can hold and transfer them, for example through KYC/AML checks.
Issuers must also be able to freeze tokens and revoke or reassign them, for example in case of lost keys or legal orders.
Without an open standard, each issuer builds proprietary security token contracts, which hurts interoperability with wallets and custody software.