Easy-Anti Cheat prevents modification to the game. Some people used malicious mods that could, for example, grab every single grabbable item in the instance and teleport them to one spot and crash people nearby as a result. Most mods were not that and everyone I know hates those people.
Some people say mods allow you to upload crasher avatars. This is not true. You can just upload an avatar with an absurd polygon count or custom shader that crashes people — no mods required. People who use these avatars are “crashers” and while they’re not as common nowadays, everyone hates them.
Some people say mods allow you to “rip” (pirate) avatars from other people, even private ones. This is partially true. Most (all?) ripping happens by taking VRChat’s local cache, de-obfuscating the avatar (or world) you want, fixing it, then re-uploading it to your account. Mods can automate this process, but EAC doesn’t stop ripping. Recently, VRChat announced that they’ve made some changes to make ripping harder, but they didn’t explain what or how. Hopefully this becomes less of a problem.
Sidenote on piracy: it’s really easy because of how Unity packages work. Ripping is a form of piracy, but piracy doesn’t necessarily mean ripping. Don’t pirate VRChat avatars or worlds. People put a lot of work into making this stuff and they need an income. There are good free avatars you can find on gumroad/payhip/etc.
tldr: malicious mods could let you be malicious. except for game worlds, you can’t really “cheat” at vrchat, but you sure as hell can make the experience worse for everyone else. most mods didn’t do that, which is part of why there was fallout when they implemented EAC to eliminate modding.