How I think about it

Segwit transaction outputs are locked by a condition that looks like this 0x0014<20 byte-key-hash>. An old node would look at that and interpret it as push an empty array on the stack, then push 20 bytes on the stack. There are no signature checks or anything. By it's rules, anybody could spend it, even by just putting 0x00 in the scriptSig of the input that spends the utxo. A post-segwit node would look at 0x0014<20 byte-key-hash> and see it as a template for a P2WPKH transaction and only verify it if it provided the correct pubkey and signature in the witness part of the transaction.

Let's say you had a pre-segwit node and were running a separate program that looks for transaction outputs whose locking conditions are only data pushes and then spends them. After segwit, your program would not work because it would try to spend the outputs, but the rest of the network would say you need to have signature in the witness part of the transaction.