Why is the strength of an Elliptic Curve Cryptography (ECC) half the size of the prime field size?
This is essentially because the best known generic algorithms for discrete logarithm, e.g., baby step giant step, have complexity $$O(\sqrt{G})=O(2^{n/2})$$
where $n$ is the number of bits to represent the elements of the elliptic curve group $G$.

If the eliptic curve group is carefully chosen, that is. So, avoid anomalous curves, for example.