Security proof for CBC as a prefix-free PRF
The answer is in the last sentence of the proof: "Once we have established that there are no collisions of these types, it will follow that all values associated with non-root nodes are random and independent, and this holds in particular for the values associated with the leaves, which represent the outputs of FCBC seen by the adversary."

To explain: we are only interested in the leaves which is the last invocation. However, the way to prove it is by proving it for all invocations. This seems quite natural because once there is an internal collision, the question of whether or not this leads to a final collision depends on the query contents, and this is unknown.