Why shouldn't middleware be the only place where you check whether a user is authorized?

Middleware alone is not enough. A misconfigured matcher can skip middleware. A check in middleware also does not protect the same data when it is reached through another route, Route Handler or Server Action. On top of that, CVE-2025-29927 showed that middleware could be bypassed with a crafted header on unpatched versions. The tempting "Middleware cannot read cookies" is wrong: middleware can read cookies, which is why it works for optimistic redirects.