A lot of the time, on SWR at least, it seems certain services run ECS just because they always have and nobody has looked at them really. The basic timetable dates from 2004, but the crew workings and ECS workings have changed since then. Some services which ran ECS in 2004 may have done so because they didn't carry a guard for example, but now they do.
The service in discussion above, which terminates at Woking at 1851 for example. The train then runs empty to Farnham Depot, with a brief stop at Farnham station to drop the guard off. Continuing to Farnham in service, even non stop, would make far more sense. The train might not have more than a handful of passengers on, but there is no doubt that having to lock out a 12-coach train at Woking in the evening peak is a performance risk, especially if the train is running a minute or two late. It would be far more out of the way at Farnham. Interestingly this is exactly what did happen in the temporary timetable during the Waterloo Upgrade work.