I'm sure it's an honest attempt to move the baseline for security up and shake off the "Windows is insecure by default" perception they've been fighting since introducing UAC.
Though it is definitely not required, IoT LTSC does not have these requirements.