OWASP ZAP is used to scan vulnerability on web application but its site says " Because this is a simulation that acts like a real attack, actual damage can be done to a site’s functionality, data, etc."
So why would someone use it to scan web app when it could damage it?
Typically, if you're trying to scan your own (or your employer's) web app for vulnerabilities, you do it on a development or test instance that doesn't use production data, so if you discover a problem, you haven't damaged anything valuable. For example, you could run the scanner as part of a CI job, or security professionals could run it against a development instance on their own machine.
Some people do indeed run vulnerability scanners against production systems and then, frequently, report them as part of bug bounties. This is unhelpful because usually organizations offering bug bounties already do this and it takes some knowledge to determine whether something is actually a vulnerability (e.g., an out-of-date version number doesn't intrinsically mean a vulnerable version). It could also cause actual problems, such as an availability incident, which would not be received favourably. However, those people are often not conscient of the problem or don't care if they think they can make a few bucks.
There are other people who run scanners on production systems because they do want to cause havoc and will intentionally use whatever they learn to cause problems or extort the owners of the web app.
As usual, this is a situation where there are people who are careful and conscientious, people who are well-intentioned but possibly reckless, and people who are out to do harm. The warning is there to help people in the first and second categories make good decisions.
