RADIUS Message-Authenticator protects a response path attackers can rewrite

Why RADIUS clients and servers must require Message-Authenticator in both directions.