Internal traffic left unencrypted because it's 'behind the firewall' becomes readable the moment an attacker is too. Enforcing TLS on every connection, internal included, denies them the easy eavesdropping that lateral movement relies on.
“Plaintext inside is plaintext for whoever's already inside.”