The main point is to protect from blockchain reorganization

River has a decent write-up 👇

https://river.com/learn/terms/r/reorganization/

another far less likely vulnerability would be double spends which become exponentially more difficult after each confirmation.