Why does enable_shared_from_this embed a weak pointer instead of embedding the reference counter directly?

The first thing that comes to mind is whether that approach would be feasible at all, and the answer is that it would not:

struct X : enable_shared_from_this {};
std::shared_ptr<X> p( new X );
std::weak_ptr<X> w( p );
p.reset();                      // this deletes the object
if ( w.use_count() ) {          // this needs access to the count object
                                //    but it is gone! Undefined Behavior

If the count is stored in the object, then no weak_ptr can outlive the object, which is a breach in the contract. The whole idea of weak_ptr is that they can outlive the object (if the last shared_ptr goes out of scope, the object is deleted even if there are weak_ptr)