I’ve seen the status code in a JSON response before: https://cloud.google.com/storage/docs/json_api/v1/status-codes#401-unauthorized
One reason I can think of for including it is that it may make it easier for the consumer to check the status code if it’s in the JSON. Depending on how many layers of abstraction you have, your app may not have access to the raw HTTP response.
Although, yeah you lose the single source of truth though.
Maybe… but why not go further?
Unless you regularly transport more than 1 person, you don’t need a car. You can rent one of those for the rare times you need it!
Buy a motorcycle or bike instead?