Let's say a client is accessing a corporate network over VPN.
If all traffic is routed over the VPN, the corporation may inspect network traffic using its existing security solutions (ie. IDS/IPS). So, if the client has malware that tries to connect to a known botnet, it will be detected.
When you are connected to the public Internet and the corporate network at the same time you basically bridge the two together. By restricting this, even if the client is infected with a remote access trojan, the connection will be broken, and a new one may be blocked from beeing established while connected to the corporate network.
It is not a perfect solution in that, malware and other tools installed by an attacker on the client, may be able to operate unattended. Ie. a keylogger logs all data and is extracted by the attacker at a later stage, or some malware detects that the client is logged into some system and then starts doing damage.
Some conditional access policies may prevent access to SaaS solutions from outside the corporate network. IPs of SaaS solutions can change without prior notice so by routing all traffic through the corporate network you don't risk users beeing suddenly blocked from logging in to those services.
The opposite of forced routing over VPN is called VPN Split Tunneling. The benefit of doing this is mainly performance related. In particular a reduction of latency from the client to Internet hosted services which may be important for some applications.