Using concat (file fragments) provided by a defined type would allow multiple applications to specify their own application accounts to be added to cron.allow and/or cron.deny without having to know anything about any other application on the system.
When building cron.allow or cron.deny based on templates one has to compile all possible system users in Hiera manually to ensure that they all get added. This is more difficult to manage.