Since VLANs will have access to other VLANs, the security argument is
You can place security (ACLs, firewalls, etc.) between VLANs, but that is much more difficult or impossible on a layer-2 broadcast domain. In the layer-2 LAN, every host has direct access to every other host on the same LAN, but not across a layer-3 boundary.
Also, layer-2 protocols (STP, CDP, LLDP, etc.) are considered security problems, and should be eliminated, isolated, or minimized as much as possible. Layer-2 protocol attacks are stopped at a layer-3 boundary. (See LAN Switch Security: What Hackers Know About Your Switches.)
Spanning tree loops and broadcast storms affect the entire layer-2 broadcast domain, but are stopped at a layer-3 boundary.
The modern best practice is to push the layer-3 boundary as close to the hosts as possible. You isolate a VLAN to a single access switch (you can have multiple VLANs on the access switch, but those VLANs do not extend to any other access switches). One way to do that is to connect the access switches to the distribution switches via layer-3. Any layer-2 problems on an access switch are isolated to that access switch. Today, there is almost nothing that requires hosts to be on the same layer-2 network, and layer-3 separation solves several problems.