assign the service principal to a reader role twice why?

Just before task 4: Assign the service principal access to Key Vault, the command az ad sp create-for-rbac -n "contoso-apps" --role reader --scopes subscriptions/$subscriptionId/resourceGroups/$resourceGroup In my understanding we are granting reader role to SP to RG why agian it is indicated

In this task, you assign the service principal you created above to a reader role on your resource group it is already done no?