It defines a firewall outside of your machine so your iptables/firewalld configuration on individual droplets can be much simpler. (assuming it works like security groups on AWS, create one apply to many.)