Lists might allow circumventing follow protection / post privacy
As you can follow everyone in lists without their approval and no special checks being done in the list timeline code to check if you are actually allowed to see their private posts, adding someone to a list allows circumventing the privacy system.