Trusted users are not the same as a trustworthy interface
An administrative or back-office interface is used by an organization's own staff, which tends to lower how much scrutiny it receives compared to a customer-facing surface — fewer external eyes, less pressure to harden it, an assumption that internal users are inherently safe. But the interface's own security doesn't automatically follow from the trustworthiness of the people using it: a credential-stuffing attack, a phished internal account, or a compromised staff device turns that same interface into an attacker's access point, and administrative interfaces typically carry more consequential capability per action than anything customer-facing does.
Because of that outsized capability, an administrative interface arguably deserves stronger controls than the customer-facing product, not weaker ones — even though the opposite is often what actually happens in practice.
Keeping the administrative path separate
Out-of-band management — keeping the administrative access path on a separate network or interface from ordinary traffic — reduces how much a compromise of the regular user-facing surface can reach. This separation tends to erode gradually as features get added for convenience: an admin panel folded into the same public application because standing up something separate felt like unnecessary overhead. Each shortcut narrows a boundary that, for this specific surface, is worth defending deliberately.