The intention was to filter invalid packages before any "user-supplied" rules can ACCEPT them.