You get tokens deposited to your address, free. It's one of the cool things about cryptocurrencies, people can just give you random monies without your approval.
if the airdropped token is a security token, then it's illegal. And since this a gray/developing area every token has a high chance of being classified as a security token.
This also may result in unwanted tax and other liabilities on the receiver's side.
It's a flaw in Push payments design. Either receiver need to confirm tx or use a design based on Pull payments.
