On a platform with multiple applications, each interface may need different data and operations. A BFF can combine responses from several services and expose a contract suited to that experience, while business rules remain in the modules responsible for them.
We do not add this layer by default to every application. It makes sense when it simplifies coordination, responsibilities or the evolution of different interfaces. Permissions must be checked on the server regardless of the controls visible on screen.