ISPs (especially mobile ones) sometimes rotate IP addresses in an little as 4 hours. Relying on static IP addresses throughout a client session might be more secure but will result in people getting logged out very frequently.
Plus, even with the most strict filtering client IP addresses can always be spoofed.
Plus, even with the most strict filtering client IP addresses can always be spoofed.