It's a security question. Handlers are visible, and can be called directly from the browser. We want to force the xblock author to tag which functions are handlers, so that a malicious user can't hit a url on the server to run an arbitrary function. (Admittedly, the risk is small, because it requires the signatures to match, but forcing tagging on the function removes the risk).