if an adversary xors their guess of part of your message and what they want it to say with the one-time-pad ciphertext, they can make it say what they want if the guess is right; this is a general vulnerability with stream ciphers

if they guess wrong, there's a little unreadable garbage in the message, but in many scenarios they only have to guess right once

so you need some kind of message authenticator like hmac