Because 'shady' traffic does you more or less no harm, unless your web application executes arbitrary untrusted input? For a serious site, the cost of allowing

Because 'shady' traffic does you more or less no harm, unless your web application executes arbitrary untrusted input? For a serious site, the cost of allowing passive reading is going to be ~0.