Why would a team use BOTH URL-level (requestMatchers) and method-level (@PreAuthorize) security together rather than just one?

URL-level rules provide a coarse-grained, centrally-visible first line of defense that's easy to audit at a glance, while method-level annotations enforce fine-grained, business-specific rules directly on the code path that performs the sensitive operation — protecting it regardless of which (possibly future, possibly newly added) controller or code path ends up calling that service method. Relying on only URL rules risks gaps if new entry points bypass the expected controller layer.