The docs just say you must do it, and doesn't really explain why? Is this just a implementation limitation of Hibernate, or is their a more profound reason for this? I mean, why can't the Hibernate framework have a default implementation
of the equals() and hashcode() methods in a composite-key scenario, just like it does for a single key? Why leave it up to the user to make sure that the xml mapping file matches the implementaions of these methods?

Object identiy issues can apply to non-composite key as well but it is a huge issue for composite keys. I suggest you read http://hibernate.org/109.html for a more detailed explanation.