Even inside a private network, each server should accept only the traffic it needs. Security groups are stateful firewalls on each instance, and the clean pattern is to let the app tier accept traffic only from the load balancer's group. They have no deny rules, so to block one bad IP you use a network ACL at the subnet level, or AWS WAF for web traffic. "Security group vs NACL" is one of the most asked cloud questions.