The script achieves two things:
- Ensures the provided public key matches the provided signature
- Ensures the provided public key leads to the same address script the utxo was locked with.
A P2PKH script contains the hash of the public key. When you spend the coins, you provide a public key, and a signature.
First, the script duplicates the provided public key, then runs it through hash160, and compares the output to the hash embedded in the locking script.
Once that check passes, it validates the provided signature against the same public key. This ensures that the signature comes from the same key that was used to generate the address.