Modern web frameworks have a convenience feature: they automatically map incoming request parameters to model fields. You don't write code to copy each field — the framework does it for you.
This is called mass assignment or auto-binding. When a developer uses it without restricting which fields are allowed, every property in the model becomes potentially settable by the user.
The server doesn't know the attacker "shouldn't" be setting these fields — it just sees valid JSON with valid field names that exist in the model. No validation error. No warning. The response looks identical to a legitimate update. The attacker has to check the effect themselves.