Because it's harder to enforce on a team whereas a central service (also as a 2nd security layer) deals with it on behalf of the team/org
>(also as a 2nd security layer)
Except when it's not.[1] That means it gives careless folks a false sense of security, which I think conveys more risk than no security at all.