I want to know the use case of state passed for getting authorization code from Resource owner the sources says that its used to prevent CSRF attacks

can anyone explain how passing the random string as state will prevent that as if my request is intercepted in between by the attacker he will also get to know this passed state as well right?