The point was that you could more easily replace the SSH server with a malicious one and e.g. hijack your agent when you connect to it.