Why composite-id class must implement Serializable?

The session object needs to be serializable hence all objects referenced by it must be serializable as well.
The id is used as a key to index loaded objects in the session. In case of CompositeId s the class itself is used as the id.