Because we want to lay down the duties of the people who host it for us, if we don’t host it ourselves. (And most people won’t host it themselves.)

If a host has just one duty, to keep the data safe and allow only authorized actions on it, then that is what the host will focus on. If the host is facebook, whose duty is to find ways to monetize its database to maximize shareholder value, you will get a different result.

That’s why the layers, and why for most people, not having too many hosts. (Some might decide to have multiple hosts to maintain multiple persona, such as a personal and work persona, but that’s their decision.)