When an address is called, somebody has to do the work. That place is the controller. It takes the request, checks what was sent with it, sets the actual business in motion and returns an answer, either a page or data.
The name misleads easily. A controller does not control anything in the sense of being in charge. It is more of a reception desk: it accepts, it passes on, it hands out.
Why it should stay slim
The reception desk is the most convenient place to put something down. Which is exactly why, over the years, everything nobody wanted to file ends up there: calculations, special cases, sending emails, an export on the side. Twenty lines become eight hundred, and nobody dares to touch the file any more.
The damage does not show immediately but at the first larger rebuild. Business logic reachable only through a page request cannot be reused, cannot be checked automatically and cannot be started from a background process. Filing it properly costs a little at the beginning and saves considerably more later.