What is the reason for having authorization rules in the database?

You can put as many logic as you want into your PHP code for your business logic. Yii supports many ways of adding this logic, eg. LoginForm.php, UserIdentity.php, SiteController.php, ... you are not limited here.

What Yii also supports is adding a snippet of logic to your RBAC. A common use case is, that you assign the two rules 'Authenticated' and 'Guest' to all users of your site by default, but with bizRules.While 'Authenticated' has a bizRule like

return !Yii::app()->user->isGuest;

'Guest' has

return Yii::app()->user->isGuest;

The outcome is, that your logged in users are not longer 'Guests' but 'Authenticated'.Another example would be edit views for user profiles, which are only editable by current user, like

return $model->id === Yii::app()->user->id;

Why would you put anything in a database vs code?

One good reason is so that non-developers can edit it.

In our app, we allow users to manage their permissions on their own users and items.

You don't have to use yii's rbac business rules. You could allow say a few different roles and tasks, and have the rest of the auth logic in code.