Why is binding @RequestBody directly to a JPA @Entity considered risky (mass assignment)?

If a request body is bound directly onto an entity with all its fields (including sensitive ones like 'role' or 'isAdmin'), an attacker can include extra JSON fields in their request that get silently bound onto fields they should never be able to set themselves — potentially escalating their own privileges. The fix is to always bind incoming requests to a purpose-built DTO containing only the fields that SHOULD be user-settable, then map explicitly (and deliberately) onto the entity server-side.