The signature on the voter registration card verifies the signature. If a request for an absentee ballot is received, and the address is different from what is on file, do they verify the change of address? Do they verify the signature on the request? If not, how do they know that the name and signature on the request are valid?
I mean if I'm going to misuse the mail-in ballot, requesting the ballot may be the easiest way to do it. I just send in hundreds of requests with my signature on it, instead of the voters', and then redirect the ballots to my location. There have been cases of people being told they voted by mail, when they went to the poll, and them responding, saying they never requested nor did they receive a ballot. Someone else had requested their ballot and returned it.
Abuse of the mail-in ballot program has to be well organized, which requesting the mail-in provides the opportunity to happen. If the ballots are mailed to the last registered address of the voter, it's really difficult for nefarious forces to harvest them in sufficient numbers to make a difference. But sending in a bunch of requests that the voters know nothing about is an easy way to set it up.