if an adversary xors their guess of part of your message and what they want it to say with the one-time-pad ciphertext, they can make it say what they want if the guess is right; this is a general vulnerability with stream ciphers

if they guess wrong, there's a little unreadable garbage in the message, but in many scenarios they only have to guess right once

so you need some kind of message authenticator like hmac

Good point I guess that’s the same as the “heil h**er” vulnerability

Maybe some kind of low density salting would make messages hard to guess but not too hard to read