There’s quite a few reasons why having the ability to change the history of a particular browser session can be helpful. The major one is handling user flow in single page applications where the browser doesn’t see page changes but the application does so you add history despite a new page not being completely rendered. Thus it gives the illusion of moving pages and changing URLs without burdening the browser with the action. It’s a pretty integral feature and there are plenty of sites that make it malicious.