Why should developers avoid using tx.origin for authentication?

Attackers can trick users into calling a malicious contract. That contract then makes a call where tx.origin equals the victim’s address. This bypasses access control and leads to unauthorized actions.