Without App Check, someone in possession of the app's configuration information could forge requests to bypass quota limits or abuse AI calls, resulting in unexpected charges and security risks.