When h exceeds 1 the curve contains small subgroups, so a point supplied by a peer can lie outside the prime-order subgroup. Protocols handle this by multiplying by the cofactor (cofactor Diffie–Hellman in SP 800-56A), clamping secret scalars to multiples of the cofactor (X25519, Ed25519), checking subgroup membership, or using an abstraction with prime order such as ristretto255 or decaf448 (RFC 9496).
Real bugs: in 2017 the CryptoNote cofactor issue allowed one Monero output to produce several valid key images, which could have enabled double spending until it was patched. EdDSA verifiers that disagree about cofactored versus cofactorless checks (RFC 8032 §5.1.7 allows both) accept different sets of adversarial signatures, which matters in consensus systems.
Weierstrass curves with cofactor 1 have none of these issues, which is one reason prime-order curves remain popular for protocols that need simple group semantics, such as multi-party computation and verifiable random functions.