It’s an old, old protocol full of 90s crypto mistakes - passwords could be brute-forced in hours over a decade ago, it still uses things like MD-5, etc. and there are attacks which cannot be solved within that protocol such as “pass the hash” where you can obtain a hash from a compromised system and use it to authenticate elsewhere even though you don’t have the original password.

There’s a long history here:

https://en.wikipedia.org/wiki/NTLM

The main problem is that there’s no way to reliably patch old stuff. If you have a large network, leaving NTLM enabled means attackers will continue to exploit it but as long as it’s an option slacker enterprise IT departments and vendors will continue to delay replacing it. Microsoft deprecated the protocol more than a decade ago so now they’re forcing the slackers to actually do it.