Regarding on-host filtering (edge analytics), my experience has been it's because of performance, and I agree with the security angle, too.