Apps are built in a client-server configuration where the app is the user facing client and the API is the server. If you listen and manipulate the data sent back and forth to the server you can often do a lot more then what the user interface allows. Whether that’s gathering and analyzing more data or completing actions the server developers never anticipated the client would attempt.

Simply put backend developers assume the client will only do what they configure it to do and won’t be tampered with, except with enough effort it can trivially be tampered with.