One place to get it right, instead of many places to get it slightly wrong
An API gateway sits at the edge of a system as a single chokepoint that all external API traffic passes through before reaching any backend service, giving a natural place to enforce authentication and coarse-grained access policy once, consistently, rather than reimplementing the same checks separately inside every individual backend service. This centralizes exactly the kind of check that's easy to implement slightly differently — and therefore inconsistently — if left to each service to build on its own.
Route-level policy is what keeps this centralization from collapsing into an all-or-nothing setting: applying a specific rule to a particular route rather than uniformly across everything behind the gateway lets a genuinely more sensitive endpoint receive stricter treatment without dragging every other route down to match, or leaving that sensitive endpoint stuck at the same laxer level as everything else.
Concentration cuts both ways
Because every request passes through the gateway, a misconfiguration or vulnerability there potentially affects every route and every backend service behind it at once, rather than being contained to one isolated service the way a bug in a single backend would be. This makes the gateway's own configuration deserve outsized scrutiny relative to how simple it might appear — 'just a router in front of everything' is precisely the framing that leads a team to under-scrutinize the single component whose mistake would actually matter the most.