Because reforming all possible aggressors ever is an uphill battle you'll never solve.

Imagine you have an API that receives a POST with some JSON. Every time your API receives a malformed POST, your application crashes or hangs. Do you a) try to do your best to make sure no one ever POSTS to your uri with malformed data, or do you b) rewrite your API to be more robust and send back an error code when malformed input is received rather than crashing?

Does that analogy make any sense or is it too far fetched?