Why is `shell=True` sometimes considered dangerous in scripts?

If the command string includes untrusted user inputs, shell=True exposes the system to shell injection vulnerabilities (where an attacker inserts extra characters like ; rm -rf / to execute arbitrary commands). If possible, pass arguments as a list with shell=False.