It's coupled to the "split personality" of the Windows 8 UI. If you start IE from desktop mode, you get "desktop IE", with desktop UI conventions, and web sites with flash will still work. If you select IE off the browser tile in the formerly-Metro "start screen", you get mobile-style UI conventions, and flash breaks unless you're on the whitelist.

Either they're expecting everyone who uses flash in a significant way to get whitelist approvals (and how many people do they have vetting those, anyway?), or they don't mind a period where, from the user's perspective, stuff randomly breaks for reasons that are not likely to be apparent. (Even if you tell them "well, it's how you started the browser fifteen minutes ago", they'll ask, "and why should that matter?" They have a point.)