Scheduled Scan: Necessary?

I have a question - hope someone can answer and help clarify this:

How can Sophos' scheduled scan detect threats that are not detected/remediated by the realtime protection? In other words, why would someone turn on the scheduled scan feature if they already have realtime scanning set up?  If a threat signature gets added after a rogue application gets installed, realtime protection would identify it when the application is run (after the signature update) anyway. Are there any use cases from Sophos or from the enterprise endpoint security users related to this?

Thanks in advance.