And with this, the permissions of something is mandatory, and are enforced so that even the owner cannot change them.
Imagine mysql running as a certain user. It has to read and write the database, and perhaps some other files - but it has no business poking in a users home directory - even though it may have read access there. A mail server? It has every reason to write to mail files - but no reason to write to a mysql database file. Denying it this permission will ensure that it's unable to - even if it runs as root and has a security issue.
MAC ensures that it can't - even if the user it runs has privileges to perform this action. Furthermore, the user should not have privileges to bypass these protections. Thus, even if the software is compromised, the damage is local to that software.
An other example would be a browser - say chromium. If I deny it permissions outside of
/home/*/Downloads/ and so on. Even if a security hole in chromium were to surface, it'd be unable to steal my holiday pictures - because it did not have permissions to read those. Even if an attacker manages to trick me into adding a unsafe extension, it can't access things that the MAC system doesn't give it access to.
You can restrict your applications to what they normally do. Thus, if a security problem occurs, they may still damage the parts they're supposed to access - but will be less likely to damage or ex-filtrate unrelated data.
MAC is another security layer. In addition to the application and file system enforcing permissions, MAC such as SELinux and AppArmor enforces another layer that determines what an application can do or not. It allows more fine grained control than traditional file permissions, and is separate from file permission - so even owner of a file can't directly bypass MAC to give it access.