I can see why you might do that, but it seems mildly hostile to me and would have broken things for me on at least one or two occasions. I know I’ve set up very simple hook arrangements before where I don’t care about authentication, at least in part because the URL is secret and it’s probably just about dumping the hook call contents for now anyway.

But at the same time, perhaps doing this would solve more problems than it creates.

It's not hostile. It's ensuring you properly authenticate the request, and that you own the target endpoint. :)