It is a layered security approach. Like when a system is hacked, law abiding users have to go through hoops with crazy passwords, 2 factor auth, etc. to deal with the psycho hacker.