The contract lends you any amount it holds, runs your code, then checks repayment plus a fee at the end. If the money is not there the entire transaction is undone as though it never happened, so the lender cannot lose. No credit check is needed because there is no credit.
Legitimate uses are real: closing an arbitrage without capital, refinancing a loan from one protocol to another atomically, or unwinding a leveraged position in one step instead of several risky ones. It genuinely democratises access to size.
It also removes capital as a barrier to attack. Anyone can command hundreds of millions for one block, which is why thin oracle feeds and governance systems with low thresholds are so dangerous. See flash-loan-attack.
Related: flash-loan-attack, arbitrage-bot, lending-protocol, oracle-manipulation