Because then your production site may be using different (newer) packages than your development site. The newer packages may break something.
Instead, run composer update in development and run your tests. Then, when you run composer install in production, you know your production site will be getting the exact same set of packages that you tested with your development site.
On a related note, never run your test suite in production.
@MikeHopley That assumes you've got a separate code base for development. For simple sites I think this is fine (like upgrading WP on the fly). Always do a backup though.
Composer install will install the packages from your composer.lock file
Composer update will update/install the packages based on your composer.json file