Azure NSG Challenge : When NIC and Subnet Rules Collide

Since the NIC-level NSG explicitly permits outbound RDP, the VM can successfully initiate the session. However, given the inbound deny rule at the subnet level, the return traffic from the external server would be blocked, effectively disrupting the connection. Would you say the subnet-level inbound restriction is primarily intended to mitigate external threats, or is it designed around a specific network segmentation strategy?