Why should alerts be based on SLO metrics (error rate, latency) rather than only infrastructure metrics (CPU, memory)?

Infrastructure metrics can be noisy without indicating real user impact (a CPU spike during a benign batch job) and can also miss real problems (errors caused by a downstream dependency with low CPU usage locally) — SLO metrics directly reflect what users experience, reducing both false alerts and missed real incidents.