Groth’16 trapdoor for simulator

In the zero knowledge definition of the Groth16 scheme (https://eprint.iacr.org/2016/260.pdf) [Section 2.2], why would the simulator be allowed a trap-door in set up? The trap-door information contains the toxic waste that should be destroyed by the set up. In another word, if the simulator (a.k.a modeling a passive attacker) learns the toxic waste, would it hurt the security of the protocol?