There are 2 main reasons why cookies are easier to steal than login credentials:
Cookies are sent for every request, login credentials are only sent once for each "session"
If you sniff a network, it is less likely that you will be in place at the point when a user actually perform a login using its username and password.
Cookies on the other hand, are sent for each request to the web server. It is just more likely that you will be able to capture a session cookie than a username/password autentication.
It is hard to predict which GET/POST parameters that contains login credentials
Sniffing the actual authentication credentials on the web can be a bit tricky. This is because virtually every web application have its own way of doing it. It is hard to anticipate all the various authentication URL's.
For example:
GET /login?username=dogeatcatworld&password=letmein
GET /auth?u=dogeatcatworld&p=letmein
GET /auth?auth=<base64encoded credentials>
Cookies on the othe hand, always exist in the HTTP header, and it is trivial to extract these from the requests.