Flexibility - allow different type of authentication methods and client platforms. The protocols are insecure. There are absolutely no means within the protocol to ensure that the system is talking to the right recipient on the other end. The operating systems are unable to protect themselves. For all major operating systems, there are security related bug reports published almost every day.
Most applications lack security.
Also, most application programmers seem to believe that if they can communicate with another party, then it is someone else's problem to make the connection secure. These three factors are the major reason why Internet and also internal connected systems need additional protection by a secure system, which goes beyond the firewall.