Narrowing what each hop in a chain actually holds
Token exchange converts one credential into a different, typically narrower one, so a service making a downstream call can present exactly the access that specific call needs rather than forwarding its own broader credential further than necessary. A service holding a token valid for many different operations can exchange it for one valid for only the single operation a particular downstream call actually requires, before making that call.
This bounds what any individual downstream service ever actually holds: instead of every service in a chain carrying a copy of the same broad, original credential, each hop holds only the narrow, exchanged token relevant to its own piece of the overall work — which directly limits what a compromise of any single downstream service in that chain could actually reach.
The cost is a more involved credential architecture
Implementing this well requires infrastructure to perform the exchange reliably and quickly at each hop, rather than the simpler alternative of just forwarding one credential everywhere it's needed. That added complexity is a real cost, and it's specifically worth paying in call chains where a compromise partway through would otherwise expose considerably more than that one link in the chain actually needed to do its job.