To quote the docs, the
overrideModeDefault="Deny" attribute is generally used to deny changes to configuration settings that:
are related to any performance, security or critical aspect of the server ... [snipped] ... If the overrideModeDefault attribute is set to "Deny", then any configuration files at a lower level (i.e. web.config files) [my emphasis]
Even in an environment where your server (public facing) is dedicated to running your own applications, it's generally good practice to not allow changes these settings. The reason being that if your site is hijacked it can't be further subverted by allowing attackers to add their own ISAPI filters or tinker with other critical settings in a site's
Another reason being is where you have developers (who are not server admins) who may not understand the implications of casually overriding a setting to get something to work in a site's
web.config which may affect the overall performance and security of the server.
If you have full control over the server then it's still better to keep these changes restricted to
applicationHost.config rather than allow them to be set willy nilly in site
web.config files. The server admin team then become the gatekeepers of any changes that might need to be applied for a particular site.