Why is BP required for employees who are not vendors?
When you get the error message saying that the user doesn't have a Business Partner when creating an EHS incident record or an MOC record, what the system really means is that the user doesn't have a "Business User". The Business Partner that the message is referring to is 1 component of the Business User.
Since S4 1809 there is a concept called "Business User Concept". The Business User Concept is basically an internal linkage between the (1) HR/PA Employee record (Infotype 105/00), (2) the User ID and (3) the Employee Business Partner record. There is also an option for customers who do not use SAP HR to use an object called "Employee" (Fiori app F2288A) instead of the HR/PA Employee record. Regardless of the type of "employee" record used, the User ID and Employee Business Partner are mandatory to achieve the creation of the Business User.
There are reports that can be run in SE38 (/SHCM/RH_SYNC_BUPA_FROM_EMPL and SHCM/RH_SYNC_BUPA_EMPL_SINGLE) to create the Business User when an HR/PA Employee record is used. If the HR/PA Employee record is not being used, Fiori app F2288A must be used. There is an excel template import feature in F2288A to help with mass Business User creation. You've probably realized that can't manually create an employee Business Partner record (since S41809). You must use one of the aforementioned processes to create them.
As to your question of why SAP has enforced the use of the Business User/Business Partner in EHS, I can't really say. When I asked the question back in 2018, I was told it had something to do with controlling the process of how/when the Central Person record (OTYPE CP in tables HRP1000 and HRP1001) is created and the Business User Concept being a mechanism to keep 1 user and 1 business partner from having multiple Central Person records which was a major issue in ECC for some customers. I think it is also connected with controlling Identity Management between the Gateway server and backend S4 system. I do know that EHS is not the only module where the Business User concept has been mandated.