Why does the mainline client limit the number of outbound connections to 8? The mainline Bitcoin client limits number of outbound connections to 8 however allows up to 125 total connections.  To achieve greater than 8 connections (due to outbound limitation) requires either using uPnp or port forwarding so that the client can accept inbound connections.

Why is there a limit of 8 connection and only on outbound connections?  Why not allow the client to create 20 or 125 outbound connections?
This is a legacy issue.

When the network was first implemented, there was a severe shortage of servers that could reliably accept inbound connections. Many people started running the client behind NAT and they could not accept any inbound connections. Meanwhile, they were consuming the available inbound connection capacity of the more limited number of machines that could accept them. The client now enables uPNP traversal by default.

Second, there were problems with the client code that caused it not to be able to support as many connections as it should have been able to. Many nodes could not even support the default 125 connections, even though their CPU and network usage was nowhere near maxed.

These days, it's just kind of stuck. My 'hub mode' patches make it easily possible for clients to support 1,500 connections. But they almost never see more than 200 clients because the network capacity limitations are long gone.

You need a healthy number of outbound connections because a malicious adversary can consume all your inbound connection slots by repeatedly connecting to you, and staying connected, from a variety of IP addresses. The Bitcoin client actually has code to try to get IP diversity in its outbound connections to protect against some entity creating a million servers and having a high chance of getting all 8 of your outbound slots.

If you're paranoid, turn this up. You can still configure for 32 outbound connections if you can also add at least 64 inbound connection slots in exchange. You'll be helping the network. You can use my hub mode patches to do this.