My uneducated guess is, some threats will burrow themselves in active memory but have no way of persisting beyond a reboot. Or perhaps it just shuts down background software you don't need that could be vulnerable.