Because the validation settings are hard coded.

Susceptible to bypass using various forms of character encoding

Because it's difficult to implement a black list filter that also takes into account data sent using the POST method

Because it is typically implemented using regular expressions to match known good data patterns