Every service needs the same things done to every request: authenticate it, rate limit it, log it, route it. Implementing that forty times is forty chances to do it differently.
A gateway does it once, at the edge. TLS termination, authentication, rate limiting, routing and load balancing, request logging and tracing — all of it generic, all of it identical for every service behind it.
The line sits between authentication and authorization, and it is easy to miss. Authentication asks whether this token is valid, which is a yes or no needing no context at all. Authorization asks whether this user may do this thing to this resource, which needs claims, ownership and plan rules — domain knowledge, in other words.
Put authorization in the gateway and it stops being infrastructure and starts being a service. Every team then needs to change it, nobody owns it, and a deployment queue forms behind the one component everybody shares.
Shared infrastructure stays useful exactly as long as it stays ignorant of what it is carrying.