Why client secret and state matter if the redirect URI is controlled?

Question

As we all know, the OAuth 2.0 protocol recommends that:

• The client secret be kept credential, and
• The state parameter be