Each system along the way with the proper priviledge could "hijack" your session (see the man page about ssh-agent, for some warnings. And search on this site and on the web for some more info) (sorry I do not have time right now to properly give examples...) :
- For example the SSH_AUTH_SOCK could be accessible to another instance of the user or to root (or, depending on the system's settings, to a wider group of users), and be used to access whatever system that you could access yourself using the keys stored in the agent.
Having only 1 base system to control and use the agent on is much easier to secure and control. Otherwise, each intermediary hop adds a (potentially weaker) point of entry for some of the users on that system.
Please note that there are also many other ways in which an intermediary system could compromise your ssh connection. Some via ssh mechanisms itself, but also some via the tty/terminals themselves, etc.
The more hop you go through, the more risk you take that one of those hops (including your original machine!) can be used to hijack your connection [to the final destination, or to any of the intermediary hops, or even to any other destination that your ssh keys could open access to ...]