Is this a Brazil law thing or businesses just using it as a readymade ID?
Both. Brazilian KYC/AML laws are based around the CPF number. It also serves corporations as a stable ID to identify people and track them. It's possible that it's a primary key in their databases.
For example, it's common to get cashback in stores in exchange for the CPF number. They track you, comply with regulations and reward you -- all with one government ID.
Until recently Brazil had no unified national ID document. Each state had theirs. It was possible to have IDs from more than one state. As the tax ID was unique for the whole country, people started using it as unique identifier of choice.