When is the Random Oracle model (not) necessary?
A hash's security in the Random Oracle Model implies its collision-resistance, first-preimage resistance, and second-preimage resistance. In addition, security in the ROM implies that the hash's output is indistinguishable from random for an adversary without knowledge of the input, and that the hash is resistant to length-extension attack, neither of which is implied by collision-resistance, first-preimage resistance, or second-preimage resistance. So when randomness or length-extension matters, a hash secure in the ROM is useful in practice, and therefore in formal proofs.

Rigorous formal proofs of protocols often are easier with a hash secure in the ROM than with some weaker hypothesis. I pass at characterizing exactly when the ROM is indispensable, and if that's related to observability and/or programmability of the random oracle.