Access to web context ONLY

At the MODX meetup in Denver last night, we discussed MODX permissions in some detail... one question that was tossed about was what scenario would require that a User Group be given access to ONLY the web context (not to the manager context). Off the top of my head, I couldn't think of a scenario where you'd define an access policy only to the web context. Can anyone think of a use case for that?

Relatedly, when setting up a membership area (via the Login Snippet), there were questions as to why the "Members" user group did not require a rule defined for its access to the context... why does it work to define only access to a resource group?

I think it's not uncommon to have users who never see the Manager. They can do their work in forms after logging in to the front end. I know of several sites where some users never see anything but NewsPublisher.