The quickest answers are: "defense-in-depth", and "plan for failure"
You have protections in place, but what if they fail? What if an attacker finds a way in using a method that you did not anticipate? From these perspectives, then, yes, rkhunter is necessary.
But, then you start asking, "when do I stop adding more protection?"
There is a calculation you have to perform about what the risks are and how probable they are, what the costs are if those risks are realized, and the costs of mitigating those risks. Every piece of protection you put in place needs to be maintained and updated, which is a cost. If those costs are lower than the costs of having an incident, then it is worth it. If not, then you are spending more than you are protecting. This quick calculation is how you determine, "is it necessary?"
There might be other more important considerations, depending on your situation. Logging? Backups? Encryption? Ease of blowing away the server and rebuilding from known good? Web Application Firewalls? Secure web application design (apart from inputs)? Getting a good third-party review of your entire environment might highlight the more important components.
I hope these ideas help.