Because one can overwrite the struct with arbitrary content, and that after the function that corrupts the struct is called, it executed a function that lives i

Because one can overwrite the struct with arbitrary content, and that after the function that corrupts the struct is called, it executed a function that lives inside that struct, so the attacker can redefine the function to call out to the system (after a few other tricks - I think)