Why can we disable Kerberos Pre-authentication?

AS-REP Roasting is a famous technique to attack the Active Directory.

You can get a lot of information saying something like "AS-REP Roasting attacks user accounts with Pre-authentication disabled. So you should not disable it". However, I struggled to find someone telling me why we can disable such a very critical security configuration like this.

I assumed you would disable it if you needed to make it to work with something which are not compatible with the Kerberos pre-authentication of Active Directory. And now I am very happy that the following article may support me.

I am sure that like me you too have seen many organizations (if not all) where this security feature of Kerberos pre-authentication is disabled for some (read many) users in order to support some applications that do not support the security feature offered by Kerberos pre-auth.

Kerberos Pre-Authentication: Why It Should Not Be Disabled

https://social.technet.microsoft.com/wiki/contents/articles/23559.kerberos-pre-authentication-why-it-should-not-be-disabled.aspx