I just happened to look at the prototype of the printf (and other fprintf class of functions) -
int printf(const char * restrict format, ...);
Why is the format in printf marked as restrict?
int printf(const char * restrict format, ...);
The restrict in some_type * restrict format is a "contract" between the calling code and the function printf(). It allows the printf() to assume the only possible changes to the data pointed to by format occur to what the function does directly and not a side effect of other pointers.
This allows printf() to consist of code that does not concern itself with a changing format string by such side effects.
Since format points to const data, printf() is not also allowed to change the data. Yet this is ancillary to the restrict feature.
Consider pathological code below. It violates the contract as printf() may certainly alter the state of *stdout, which in turn can alter .ubuf.
strcpy(stdout->ubuf, "%s");
printf(stdout->ubuf, "Hello World!\n");
@HolyBlackCat has a good "%n" example.
Key: restrict requires the calling code to not pass as format, any pointer to a string that may change due to printf() operation.