ActiveRecord models and their instances have an unimaginable API surface. Any location that gets an ActiveRecord instance passed in as argument can use the full API.
This can lead to unwanted consequences like querying the database in unit tests. Something that in most cases is not desired.
Allowing method calls to ActiveRecord models and instances only in controllers and other models could solve this problem.