Why is *splitting every word* is a shell security hole?

[shynur .]

Hi, friends,

I'm reading the paper by Chet Ramey.
Here: <https://tiswww.case.edu/php/chet/bash/rose94.pdf>.

In section 4.2.5:
> Bash and ksh split only the results of expansion,
> rather than every word as sh does, closing a
> long-standing shell security hole.

Why is *splitting every word* is a shell security hole?
Can someone give me an example?  Thanks!