The reason it's less robust is that I could use curl to send a DELETE request for records I shouldn't be able to delete. Or POST some data saying my order is paid in full. Business logic that matters at all has to be validated by some authority. The client is never good enough.
Just because I'm authorized to create a record doesn't mean it's a valid record. Take my new order example. If all business rules, including payment authorization and payment record keeping, are handled client side, I can easily say that a valid payment has been made when it hasn't.
I can see how there's a class of applications that would need the level of verification you're talking about(payment authorization being a good example). Many apps don't need that level of verification though, an app like trello for instance only needs to authorize actions against an entire resource, not values within a resource.
