AWS documentation on below link asks to allow full outbound internet access on EMR master security group for the cluster which is in private subnet.

<https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-man-sec-groups.html#emr-sg-elasticmapreduce-master-private>

However full outbound access poses risks. What is the rationale behind this full outbound internet access?