It facilitates some moderately tricky things like creating symlinks, hardlinks, and junctions (via its mklink built-in), and its scripting language, awful though it is, is better than nothing in the case that powershell, WSH ( cscript or wscript), and so on are blocked and so is running arbitrary downloaded, compiled, or remote executables. If most software is blocked (even stuff that doesn't need admin) - that is, if software is whitelisted rather than blacklisted - then cmd might make a difference. If the attacker already has the ability to run arbitrary code other than cmd, the presence or absence ability to run cmd itself is mostly irrelevant. In general, cmd isn't a well-favored target for attack payloads - its scripting language is weak and a hassle to code for, and the much more capable powershell can now be expected on basically all Windows installs - but it is still the default shell and therefore some stuff will use it by default. This will actually break some malware that specifically tries to invoke cmd without having fallbacks to other shells, but it will also break some legit software that uses functions such as system or otherwise spawns cmd processes.

There's nothing you can do with cmd that you can't do with any other program, except run cmd.

Mirc chat executable command line