In the name of security for the millions of BYOD devices that connect to eduroam. Only 0.1% may find inbound or strange ports useful but probably a double digit percentage of BYOD devices find unfiltered networks (particularly inbound or peer to peer communication) to result in massive continuous malware outbreaks.

Usually to protect the random unprotected machines on the local network (and the rest of the world from the poorly administered machines), in my experience.

Some of it often boils down to mindset of the admin - allow everything unless you know it is a problem, or block everything unless you ‘know’ it is good.