Mass assignment creates or updates a model with an array, like Produit::create($data). To prevent a user from setting a sensitive field (an admin role, for example), the model declares $fillable (allowlist) or $guarded. You never pass $request->all() to it without validation.
Example
protected $fillable = ['nom', 'prix'];