Why would a pipeline run a security scan as a blocking gate rather than just an informational step?

An informational-only scan can be ignored under deadline pressure, so vulnerabilities accumulate silently; making it blocking (failing the build/deploy on critical findings above a threshold) enforces that security debt can't be deferred indefinitely without an explicit, visible decision to do so.