The purpose is to make it clear to the user what certificate is deployed on their VMs.
If you create a VM and then update your secret in the key vault, the new certificate isn't downloaded to your VMs. But your VMs appear to reference it, and new VMs get the new secret. To avoid this, you're required to reference a secret version.