Because there isn't any functionality to detect when those DNS names change, so you can't use dynamic endpoints on both ends. You can use mobile IPsec for dynamic on one endpoint but one must be static.
Lots of discussion on this in the list archives if you want more details, it's also already posted in the feature requests section.
http://www.google.com/search?q=dyndns+ipsec+site%3Am0n0.ch