Inserting values directly into db-syntax in C#

INSERTing values without parameters is fully understandable why it shouldn't be allowed, where you e.g. want to prevent sql-injection. However I do not understand why it's still a big no doing the following as well:

 cmd.CommandText = "SELECT * FROM [Students] 
                    WHERE StudentID = " + studentID + ";";

                    int getID = (int)cmd.ExecuteScalar();

What's the harm in it when just SELECTing? I don't really understand the point with parameters below. I'm not questioning it, I just want to know the reason why parameters is necessary and what consequences I could get from the code above instead using the option below.

var pStudentID = new SqlParameter("@studentID", SqlDbType.Int);
                pStudentID.Value = studentID;
                cmd.Parameters.Add(pStudentID);