I checked doc find it, that could explain my question. Actually in Corda internal implement status that be serialized to java bytecode store into corda core database table. it is very hard to read. need invoke related way to unserialized to get. so to useQueryableState it can easy to disclose. so it is only-read, can't be changed right?
NodeSchemaService and HibernateObserver
The HibernateObserver runs within the node framework and listens for vault state updates, the HibernateObserver then uses the mapping services of the NodeSchemaService to record the states in auxiliary database tables. This allows Corda state updates to be exposed to external legacy systems by insertion of unpacked data into existing tables. To enable these features the contract state must implement the QueryableState interface to define the mappings.