Why is it a Bad Idea To Allow Any IP Address to Access My EC2 Instance?

Why is it a bad idea to allow any IP address to access my EC2 instance in group securities and what would I do to avoid this, how would a user access the EC2 server if for instance it was running a nodejs webapp on it?