Well, maybe to avoid going global.

Mostly it's abuse control, and it lands on the read side because the read and write paths share one WebSocket, so you can't gate only writes. Once every subscription is tied to a pubkey you can rate-limit or ban the heavy queryers, and a lot of the load on a public relay comes from those broad scans...

There's only a single acceptable auth use-case: nostr:nevent1qvzqqqqqqypzplrsshpc8wn3w3tsf0wpcmhu7latqxt4q809nrz7d3fh4s9n9fxtqyd8wumn8ghj7un9d3shjt35x33xjmrvd9hkutnwv46z7qgwwaehxw309ahx7uewd3hkctcqypg5y82dem22cv4d8859y9anryvzzsekkc23ddyle6xal6mstnxwup2w3nv

You want some exclusive content to be seen only by people who pay you, or by your friends.