Indeed, you usually try to drop traffic as close to the edge as possible.

However, one reason for filtering out on an interface could be if you have a router with multiple interfaces and wanted to secure (default deny) the zone behind one of those interfaces from all other interfaces. Then it's much easier to "deny ip any any" out on said interface than try to deny in based on destination on all other interfaces ...

Ammo