Shopify OAuth: State parameter useful when the auth server also returns a signed shop id?

Question

Background: I think I understand how the state parameter is used in oAuth to prevent CSFR attacks against the redirect_uri.

Situation: I am looking at this in the context of implementing a Shopify App and am having problems to see how the recommended state check on the client is adding to security in that case.

In Shopify`s oauth flow

• The URL to start the auth flow is tied to a shop (and its logged in admin users), e.g. https://{shopID}.myshopify.com/admin/oauth/authorize
• The authorization server also sends back a hmac signed shop parameter (in addition to the code and state parameters) in its response to the redirect_uri – see Shopify docs

Question: How is checking the state in the auth callback within the Shopify Auth flow improving security?

Given

• That the authorization URL is accessible to logged in shop admins only and
• that we can verify the shop parameter (via hmac) on the callback/redirect and tie any actions to the corresponding shop/user within our app.

My understanding is that a CSFR attack could only be carried out by another staff/admin account who can log into the same shop anyway and access the same app (in which case there really is no need to carry out a CSFR in the first place)?

What am I missing here?

Thanks for helping me understand this.