Because most of the times we configure roles so that users assigned to a group can only see documents from this group, it's a better default that in reports they can only select the groups they are affected to (and the sub categories of these groups).

For more complex security configurations, the script Base_getDialogSectionCategoryItemList can be customised.