For example, let all your Droplets talk to each other (and no one else), but not have to explicitly track the list of IPs and generate firewall rules from that list on every host every time it changes.

Deny outbound access except through specific hosts (config management, internal package mirrors) so that even an attacker with root can't phone home.

The same reasons anyone uses firewall devices vs. host-based firewalls.