It used to be that Kali would start a ton of services at boot and open those ports up to the LAN interface. Stuff like Postgresql that you probably don't want to expose any wider than localhost.
It also defaulted to running as a root user for everything, but they recently changed that.
It also defaulted to running as a root user for everything, but they recently changed that.