Let's say there is a signature to transfer an amount of tokens X use in function call f().

If X isn't part of the signature itself, then someone can take the same signature but when calling f() pass in a different (say larger) parameter for the token amount.

The signature will still verify since the amount wasn't part of the signature, but now more tokens will be transferred than the signer intended.

Every parameter which is important to making the function call f() work correctly should also be part of the signature passed to f() and used to validate the call.

Hope this explanation helps!