I mean, why not a hundred validation nodes, for example? Anyway, why every node couldn't be a validation node? Does it punish the performance?
Firstly, there are 21 active block producers, not validators. Everyone can be a validator, and anyone can be a candidate or inactive block producer.
If the question is why only 21 active BPs, it's a number that Dan Larimer arrived to after some experimentation in his previous projects (BitShares, Graphene, and Steem.) For instance, one of Dan Larimer's previous project, BitShares had 101 producers, and he mentioned that this raised a significant governance issue as members of the community wouldn't keep up with researching 101 different BPs and educate themselves to vote accordingly. Therefore, based on user feedback, he decided on a number that would allow people to stay informed while also providing security via block producing decentralization.
For Dan Larimer's explanation, see this video interview. Excerpt:
I introduced first version of DPoS with 101 block producers. They were all elected by approval voting, and then BitShares 2--or Graphene--reduced the number from 101 to a user-defined number so that as people vote they can vote... if they vote for more, then there will be more; if they vote for less, there will be less, and that gives you an idea of how many people the community is actually able to vote for and what we saw was that when the community is in control the quantity it stayed around 15 people or so.
So with Steem, I made the decision to just hard code it to 21, which would be more decentralized than the community was doing on its own and BitShares because that was about the throughput of the attention and the ability of people to vote.