Why do I need to use `msg.sender` in my function if I pass an address as an argument?

Question

Learning Solidity. Love it so far but would like to understand why the following block doesnt work.

contract Whatever {   
    mapping (address => uint) public ledger;    
    function withdrawAllMoney(address payable _to) public {
        require(ledger[_to] > 0, "You do not have permission to withdrawl funds.  Deposit first");
        uint sent = ledger[_to];   // <----- error here - telling me to use msg.sender
        ledger[_to] = 0;
        _to.transfer(address(this).balance);
    }
}

I'm curious as to why I cant index into my mapping at the addres I'm passing into the function: ledger[_to] as the require block seems to work. Is there a security reason behind not being able to transfer without msg.sender ?

Answer 1

I think that because you want to withdraw all the balance

  address(this).balance

Technically only the owner of the contract should be able to call this. Based on your code anyone can withdraw all the balance.