Theoretical reason: because that's what the HTTP spec says.

Practical reason: because browsers have prefetching systems that might GET resources without asking the user, which might be authorized anyway.