Difference between yarn/npm5 lockfiles and exact package versions?

My simple question is: why can't I just use exact versions in my package.json? How is this different from a lockfile?