Because, "you passed my app crap data, therefore it's not my fault that it shat all over the system" is not a defence. That's why.

Security built in at all levels = good.

A thin veneer of security applied as an afterthought = bad.

(Bill - because he knows what happens when you pop-rivet an authentication skin onto something with more holes than Rab C. Nesbitt's vest)