It makes more sense when you think of how syncing music worked for iPods.
Music went from your PC to the iPod, and that was the only way. You’re syncing your iPod with your PC to make your iPod match your PC. The iPod touch came out and let you download music on the device, but when you went to sync to make the data match you gotta make it match. Either copy the data to your PC, or delete it from the iPod.
In 3 years I haven’t had a single attempted connection that wasn’t me. Once you get to the ephemeral ports nobody is scanning that high.
I’m not saying run no security or something. Just nobody wants to scan all 65k ports. They’re looking for easy targets.