I'd guess that there are a lot of small and big shops out there, which uses bcp and sqlcmd regulary (e.g. bcp for simple import / export tasks where SSIS is just to big and clumsy and sqlcmd.exe for the default jobs created by Ola's maintenance solution) as server tools. Having them to be installed separate would slightly increase the security (when they are NOT installed) but could cause trouble too (when forgotten to install) and decrease security (when you miss a critical security hotfix for them, while you always install the latest CUs for the SQL Server main installation).

Of course it would be nice to have "regular" import/export routines, which does not need to use external tools or legacy stuff as the Ole Automations.