Think of them as a defence-in-depth that protect from accidental misconfiguration, software bugs, local exploits, etc.