You save shit all if every container comes with sidecar doing the actual TLS, it's extra component to debug and extra small latency added.
It adds complexity with the side car but usually you get standardized RED metrics regardless of if the service implemented them.
You can also have the sidecar do connection pooling and maintain persistent or long lived TCP connections which ends up speeding things up without doing that at the app level.