Why not hardened keys in addresses BIP44?
Change in this case represent external/internal chain. Usually if that's external chain, you can share it with parties. Imagine having a client which is obliged to send you bitcoin very often. If you'd give him xpub for the whole external chain, he can generate addresses on his own and you don't have to be bothered. It's not heavily used, but sometimes happens. 

If this derivation was hardened, the external party couldn't derive child keys (addresses) for this chain. Also watch-only wallets wouldn't be a thing. 

BIP44:


  Constant 0 is used for external chain and constant 1 for internal
  chain (also known as change addresses). External chain is used for
  addresses that are meant to be visible outside of the wallet (e.g. for
  receiving payments). Internal chain is used for addresses which are
  not meant to be visible outside of the wallet and is used for return
  transaction change.
  
  Public derivation is used at this level.