It helps to prevent scams because you know who the money is going to (not foolproof, of course). CPF in Brazil is not as fragile or sensitive as the SSN in the US. You can't easily wreck someone's life just because you know their name and CPF. CPF numbers are shared pretty much everywhere since it's a unique identification code for a single person. All businesses ask for it when they're generating invoices/receipts etc. You basically use your CPF everywhere and there's virtually no risk in sharing it. That's not to say that identity theft is not a thing in Brazil. It definitely is, however the damage is usually not as bad as the stories you hear in the US and the blame is usually put on the banks / service providers for not doing the proper KYC to verify the documents. It'll be a headache for the person, but usually something that is quickly fixed.

Before Pix, people already needed to put the full number, the CPF, and Bank agency number, so it's an improvement compared to old Brazilian transfers.