Mostly it's abuse control, and it lands on the read side because the read and write paths share one WebSocket, so you can't gate only writes. Once every subscription is tied to a pubkey you can rate-limit or ban the heavy queryers, and a lot of the load on a public relay comes from those broad scans rather than people reading their own notes. The catch is that anything that can't sign a NIP-42 event is now locked out, so you trade a bit of openness for a relay that survives.