It matters because attacks rarely stay in one place. A sign-in from an unusual location, a mailbox rule created minutes later, and a process starting on a workstation are three unremarkable events individually and one obvious story together.
The common misunderstanding is that correlation comes from the label. Signals can only be correlated if the products producing them are genuinely integrated; assembling tools from different vendors and expecting the story to assemble itself produces a dashboard with more sources on it, not better detection.