. It is necessary to have the session invalidated so after logging out no protected resources can be accessed. But why should I want to change the session id? Defense in depth?
The Session ID itself can be viewed as a piece of private information that was associated with the authenticated user session. Clearing this ID from the client side ensures that this private value is no longer available.
Yes it is a sort of defense in depth, as you will be able to verify from the client side that the session has changed which would imply that the server does not know anything more about the current session (i.e. not tied to any user account or is holding any private data, etc). If you were reviewing an application against the ASVS standard and you noticed that the Session ID had changed on logout you can be pretty sure that all session data has been cleared and is no longer available from the client. Yes, technically it is possible to code a system to migrate any session data to the new session, but as there is no real reason to do this it is a good measure of the quality of the application's session handling.
In addition, sending the old ID can be done as part of the testing to ensure that it is no longer recognised as an authorised session.