Why is IoT device and web app allowed to set the value for desired state and reported state respectively?

Question

Assume we have an IoT device (thing) working with AWS IoT Core device shadow (thing shadow); and a web app working with the same thing shadow.

The state is communicat