Comment by ChrisSD

Because they already have the run of the user's profile. Why add additional complexity for less access?