In package.json, there is no guarantee that all users will have the same packages unless you specifically specify the exact version in package.json. This also applies to the dependencies used by those packages and their own dependencies, creating a chain effect. This lack of consistency led to the development of lock files.
Personally, I find dealing with conflicts caused by this lack of version control to be quite time-consuming.
Conflicts arise when different users do not have the same versions of packages installed. If they were consistent, conflicts would be minimized.
For example, if your package.json includes v^1.0.0, it will install any version above 1 but below 2. The lock file records the precise version installed (e.g., v1.0.6) as well as the versions of all connected dependencies at that moment. Without a lock file, installing months later will lead to installing whichever new version fits the pattern, resulting in a new lock file that does not match the previous one.