More specifically, it guards against another site (bad.com) building a form that submits a valid request to modify data on another site (good.com) since it's im

More specifically, it guards against another site (bad.com) building a form that submits a valid request to modify data on another site (good.com) since it's impossible for the bad.com to know the value of the token associated with the user's cookies on good.com