The rules are like in the real world. Imagine you own a Swiss bank. To insure the security and confidentiality of your customers, you want to make sure your employees cannot access to whole system but only have the necessary rights to be able to perform their job, not more. This is called the least privileges concept (and also segregation of duties but that's not the main focus for your question).
Same occurs with computers, ideally a "normal" user should be able to modify only the data he owns (his personal data) or eventually some data he shares with some other users on the system. He should also be able to read some other data he doesn't own but that he needs and should not be able to access some other data at all (i.e: some system data or other users personal data). But you're not just a normal user, in some case you might also need to temporarily become administrator of your computer, for example to update the system, add or remove applications, change some system-wide settings (so not your personal user settings that apply only to you and that are stored in your home folder), to perform some backups that are not limited to your personal data, etc... In this case there is no more segregation of duties since you can do anything as an administrator and you can potentially do dangerous things that may break your system). Also running applications with administrator rights, means these applications have administrator privileges and thus could do things they shouldn't or be abused to do bad things on your system. That's why it's important to not use sudo when not necessary (look at the old windows, users were administrators by default and security was almost non existent).
For example, if you want to install or remove a program, you have to use "sudo eopkg it/rm" because it requires elevated privileges on the system (a package could delete things anywhere on the system, modify the kernel, etc.). but if you want to have details about a package "eopkg info" doesn't require any special rights since these info are publicly available to all the users of the system.
Another example is "journalctl", anyone can run this command, but it will show only the journal entries (logs) related to your or "public" processes. If you run "sudo journalctl", you'll also see other users or system processes that might eventually disclose private data or problems (wrong configuration, bugs, ...) that could potentially be exploited to do things that should not be allowed.
Last but not least, on home computing segment, sudo usually means temporary root (administrator) access, but actually sudo can be configured to allow to only perform some actions like running a specific command that requires elevated privileges but not all the commands, or to run a command without being prompted for a password, etc... This is usually used in the enterprises world and more specifically on the servers.
