The point is that with stateless authentication, you can’t revoke tokens. If a JWT gets compromise, you need to either wait for it to expire or log all users out by rotating the signing key.

With stateful authentication, solving this is trivial: just check your tokens/sessions/whatever against a centralized database every request.