What is the reason for incorporating the lengths of the associated data and ciphertext into the calculation of the authentication tag in GCM? Is it for security?
Well, if the lengths were not included, then an attacker could modify the ciphertexts (or the AAD), and still have something that would be accepted by the receiver.
Here are some of the obvious ways an attacker could do this:
He could add (or remove) trailing 0 bits (or bytes); as long as the number blocks remains constant, this would not change the tag. Of course, this is because GCM uses an all-0 padding at the AAD and ciphertext; as designed, that's safe (because of the length block)
He could prepend a block of all 0's to the AAD (and if there is no AAD, he could do that to the ciphertext); because the polynomial that GHASH computes start with the 0 value, an initial 0 value would still result in a 0 (and thus not change the tag)
He could migrate part of the AAD to the ciphertext (or versa-visa); for example, if the AAD consists of blocks $AAD_1, AAD_2$, he could make the AAD the single block $AAD_1$, and prepend the block $AAD_2$ to the ciphertext. Again, without the length block, this would be undetected.
Of course, it would be fairly easy to tweak how GCM worked internally so that the first two methods wouldn't work (use a padding method other than all-0's, start the polynomial with the value $H$ rather than 0); however the third attack would be harder to mitigate.