What's the difference between --read-only and just permit SELECT queries?
To the user, probably no difference.

To the system integrity, --read-only prevents you from accidentally writing to a Slave, thereby messing up the Replication integrity.

Aurora has no control (I assume) over whether you grant write permission and happen to let them hit a Slave with an UPDATE.  This is an easy, simple, prevention.